Abraham Maslow argued that human beings cannot pursue love and belonging if they are starving, and cannot chase self-actualization if they don’t feel safe. He argued that needs are hierarchical, and skipping layers doesn’t make you more evolved — it makes you unstable. Does the same logic apply to risk managers?

Most organizations hire risk managers and immediately expect them to influence strategy, challenge executives, and transform culture. They skip the foundation entirely. The result is predictable: sophisticated-sounding frameworks built on sand, risk reports that nobody reads, and heat maps that create the placebo effect l while decisions get made in the hallway without any risk input whatsoever. This pyramid is an attempt to describe what genuine mastery in risk management actually looks like — layer by layer, from the ground up.

Layer 1 — The Foundation: Probability Theory, Decision Science, Behavioural Economics & Ethics

Every profession has a body of knowledge so fundamental that practicing without it isn’t just ineffective — it’s dangerous. For doctors, it’s anatomy and physiology. For engineers, it’s mathematics and material science. For risk managers, it is probability theory, decision science, behavioural economics, and ethics. Not one of these four. All four, inseparably.

Probability theory is the language of uncertainty. Without it, a risk manager cannot distinguish between a risk with a tight, well-understood distribution and one with a fat tail that could wipe out the organization. They cannot explain why “most likely” is not the same as “expected value,” or why averaging scenarios produces a number that will almost never actually occur — what Sam Savage calls the Flaw of Averages. They cannot construct a meaningful loss distribution, challenge a flawed model, or explain to a CFO why a budget built on single-point estimates is a fiction. Probability theory is not an advanced topic for quants. It is the baseline.

Ask RAW@AI about this post or just talk about risk management

Decision science sits alongside it as an equal partner. The goal of risk management is not to produce a risk register — it is to improve decisions. Decision quality frameworks, developed by thinkers like Carl Spetzler, Howard Raiffa, and Ralph Keeney, provide a rigorous structure for thinking about choices under uncertainty: Are the alternatives clearly defined? Is the information we’re using reliable? Are we clear about what we value? Are we actually committed to acting on the analysis? A risk manager who cannot connect their work to a specific decision being made is not managing risk — they are producing documentation.

Behavioural economics is fundamental because it explains why humans — including experienced executives and risk managers themselves — are systematically terrible at reasoning under uncertainty. Daniel Kahneman and Amos Tversky’s work on cognitive biases, Paul Slovic’s research on risk perception, and Dan Ariely’s work on predictable irrationality all converge on the same: our intuitions about probability are unreliable, our confidence is miscalibrated, and our judgments are shaped by framing effects, anchoring, availability bias, and overconfidence. A risk manager who doesn’t understand this will faithfully reproduce these biases in every workshop, every risk assessment, and every board report they produce.

Ethics and intellectual honesty complete the foundation, and they may be the most important element of all. The risk management profession is littered with practitioners who knew that a heat map was mathematically indefensible, that a qualitative risk score was meaningless, that a risk register was a compliance exercise disconnected from any real decision — and said nothing. They signed off on pseudoscientific tools because it was easier, because the client wanted it, because the auditor expected it. This is a form of professional dishonesty that causes real harm. It wastes organizational resources, creates false comfort, and crowds out the space where genuine risk analysis could have happened. The courage to say “ERM is wrong, and here is a better approach” is not optional. It is definitional.

Without this foundation, everything above is borrowed competence — a risk manager performing the role without genuinely understanding it.

Layer 2 — Domain & Business Knowledge: Understanding How Value Is Actually Created and Destroyed

The second layer is where many technically brilliant risk managers quietly fail. They can build a bow tie in their sleep, they understand Bayes’ theorem intuitively, they can cite Kahneman from memory — and yet their risk analysis consistently misses what actually matters to the business. The reason is almost always the same: they don’t deeply understand the industry, the business model, or how decisions actually get made in the organization they work for.

Domain knowledge is not about becoming a subject matter expert in every technical discipline. It is about understanding how money is made and lost in a specific context. In a mining company, the critical uncertainties are ore grade variability, commodity price distributions, equipment failure rates, and geopolitical risk in operating jurisdictions. In a bank, they are credit concentration, liquidity mismatches, and interest rate sensitivity. In a supply chain business, they are supplier dependency, demand volatility, and logistics disruption. Generic risk frameworks applied without this contextual understanding produce generic risks — which is to say, useless ones.

There is a useful thought experiment here. Imagine teaching Monte Carlo simulation to a mechanical engineer with twenty years of experience in a specific industry, versus teaching industry knowledge to a statistician with no operational background. The first is achievable in weeks. The second takes years, if it happens at all. The implication is significant: the best risk managers are not risk specialists who learned about business, but business professionals who learned about uncertainty. Domain knowledge is the harder and more durable asset.

This layer also includes understanding how decisions are actually made in the organization — not how the governance chart says they should be made, but how they really happen. Who has informal influence? Which decisions get made in the planning cycle versus in ad hoc meetings? What is the real risk appetite of the leadership team, as revealed by their actual choices rather than their policy documents? A risk manager who doesn’t know the answers to these questions will consistently bring their analysis to the wrong people, at the wrong time, in the wrong format.

Layer 3 — Translating Uncertainty into Decision Language: The Craft of Making Analysis Matter

A risk manager who has mastered the foundation and developed deep domain knowledge now faces a different kind of challenge: making their analysis actually change what people decide to do. This is harder than it sounds, and it is a distinct skill from both analysis and communication in the conventional sense. It is the craft of translation — converting the language of probability distributions into the language of business consequences, and doing it in a way that moves decisions.

The failure mode at this layer is common. The risk manager produces a technically rigorous analysis — well-calibrated distributions, a properly constructed bow-tie or model, sensitivity analysis showing the key drivers — and presents it to a leadership team who nod politely and then make the same decision they had already planned to make. The analysis was correct. The translation failed.

What does good translation look like? It means replacing “high impact” with “$3 million to $12 million, with a 20% probability of exceeding $8 million.” It means presenting not a single recommendation but multiple options with explicitly different risk profiles, so decision-makers can see what they are actually choosing between. It means connecting the uncertainty to a metric the audience cares about — not “probability of project delay” but “the range of outcomes on your bonus is $0 to $2.4 million depending on how this risk plays out.” It means knowing your organization’s risk profile well enough to say, as in the insurance context, whether you are paying $1 million for coverage you don’t need or exposed to a $4 million loss you haven’t accounted for.

Visual tools matter here — fan charts, tornado diagrams, scenario narratives — not because they are aesthetically pleasing but because different people process uncertainty differently. A CFO might respond to a distribution graph. A CEO might respond to a concrete scenario narrative. A board member might respond to a comparison of outcomes across three strategic options. The skill is not in having one powerful format but in knowing which translation works for which audience.

Risk analysis that doesn’t change what someone chooses to do has not created value. It may have been intellectually satisfying. I am guilty of plenty of those. It may have satisfied a governance requirement. But it has not done the job. Layer 3 is where analysis becomes impact. I have done plenty of those as well.

Layer 4 — Influence & Organizational Change: Getting to the Table Before the Decision Is Made

Mastering the first three layers makes you a genuinely excellent risk analyst. Layer 4 is what makes you an effective risk manager. The distinction is critical, and it is organizational rather than technical. The best analysis in the world creates no value if it arrives after the decision has already been made, if it goes to the wrong people, or if the organization has learned to route around the risk function entirely.

The central challenge of this layer can be stated simply: getting invited to the table before the decision is locked. In most organizations, risk managers are brought in after the strategy has been set, after the project has been approved, after the vendor has been selected — to document the risks of a path already chosen. This is not risk management. It is risk theater. The organizational change required to fix this is significant, and it cannot be achieved through technical excellence alone.

Influence at this level requires building credibility through demonstrated wins. Not through explaining why heat maps are wrong — through showing what a better analysis produces. Not through criticizing the existing process — through quietly doing something better and letting the results speak. When a risk manager’s model reveals that a capital project has a 35% probability of exceeding budget by more than 20%, and that projection turns out to be accurate, the credibility earned is worth more than any number of governance presentations. Organizations change their behavior based on evidence of value, not arguments about methodology.

This layer is ultimately about making risk analysis the default input to decisions that already happen — not a parallel process, but an improvement to existing ones. In budgeting, it means replacing single-point forecasts with distributions: instead of “our budget is $50M,” the conversation becomes “$50M at P50, with a P90 of $58M — here is the contingency we actually need and why.” In vendor selection and contract negotiations, it means scoring suppliers on credit and performance risk before awarding contracts, setting advance payment limits based on loss estimates, and building risk-adjusted performance metrics into the evaluation itself. In project management, it means running simulations on cost and schedule drivers to set reserves at a chosen confidence level — not applying a blanket 15% contingency that locks up capital unnecessarily while still leaving the project exposed. In operational decisions and trade-offs, it means making the hidden costs of budget cuts explicit: reducing preventive maintenance by $500K typically increases unplanned downtime by 15–20%, costing multiples of that in lost production — a trade-off that should be a conscious decision, not a silent assumption buried in a spreadsheet. Or comparing different operational options, like bigger trucks or conveyor belts, based on their cash flow and risk simultaneously. In insurance, it means understanding your actual loss distribution before walking into a broker conversation, so you are negotiating from exposure knowledge rather than inertia — the difference between paying $4M for coverage that doesn’t fit and paying $1M for coverage that does. The pattern across all of these is the same: risk analysis happens before the decision is made, connected to a specific choice, expressed in the language of money and outcomes.

The measure of success at Layer 4 is not whether the risk manager produces good analysis. It is whether the organization makes better decisions because of them.

Layer 5 — Teaching & Multiplying: Making Yourself Structurally Redundant

The pinnacle of the pyramid is, paradoxically, the layer at which the risk manager’s personal contribution becomes least visible. Layer 5 is not about being the smartest person in the room. It is about making the whole room smarter — and then making yourself structurally redundant in the best possible sense.

The fundamental constraint of a risk manager who has mastered the first four layers is time and presence. They cannot be in every strategic planning meeting, every project approval discussion, every vendor due diligence review. The organization makes hundreds of decisions of varying importance every year, and a single risk manager — however skilled — can only directly influence a fraction of them. Layer 5 is the answer to this constraint.

Teaching and multiplying takes many forms. It means developing other risk managers who think in RM2 terms — who ask “what decision does this analysis serve?” before they build anything. It means building tools, AI agents, and content that scale the thinking beyond what any individual can do manually. It means creating communities of practice where decision-centric risk thinking becomes the norm, where project managers run their own scenario analyses, where finance teams build stochastic models into their planning processes as a matter of course. It means, ultimately, that risk thinking becomes as natural in the organization as thinking about costs or timelines — not because the risk manager insisted on it, but because enough people have been taught to see its value and have the skills to apply it.

The highest expression of this layer is cultural. An organization that has genuinely internalized decision-centric risk management doesn’t need a risk manager to tell it to think about uncertainty before making a major decision. It does so because that is simply how it operates. Risk is not a department or a process — it is a lens through which every significant choice is examined. Building that culture is the work of years, and it requires every skill developed in the layers below: the intellectual foundation to know what good looks like, the domain knowledge to make it relevant, the translation skills to make it accessible, and the influence to make it stick.

One thing Maslow understood, and that this pyramid tries to honor, is that the layers are not stages you pass through and leave behind. A risk manager at Layer 5 still needs their probability theory. Their domain knowledge continues to deepen. Their translation skills are exercised every time they teach. Their influence is the accumulated credibility of years of demonstrated value.

The pyramid is not a ladder you climb and forget. It is a structure you inhabit — and its strength depends entirely on what you built at the bottom.

Explore RISK-ACADEMY’s decision-centric risk management resources, courses, and AI tools at https://riskacademy.ai. Join the global conversation at Risk Awareness Week 2026: https://riskawarenessweek.com  Sign up for our new insurance ScyAI at https://scyai.com/ 

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

Continue reading

What if everything your organization calls “risk management” is actually making you poorer and more vulnerable?

While companies worldwide pour billions into risk registers, ERM frameworks, and risk committees, they’re missing the most profound opportunity in modern business: transforming risk management from a cost center into a profit engine that could slash expenses and generate significant cash flow growth.

The container revolution that changed everything

Picture this: Until the 1960s, shipping costs fluctuated wildly – expensive one month, cheap the next, then catastrophically expensive again. Loading a ship took eight days. Cargo theft was rampant. Insurance costs were crushing.

Then came a simple steel box.

Ask RAW@AI about this post or just talk about risk management

The shipping container didn’t just improve logistics – it revolutionized global commerce. Shipping costs plummeted by 97%. Loading times dropped from eight days to half a day. Cost per ton fell from $6 to 16 cents. Insurance costs slashed by 80% – not the typical 5% brokers promise, but 80%.

Most remarkably, this dramatic reduction in uncertainty and volatility didn’t just cut costs – it exploded global trade. Suddenly, manufacturers could plan with confidence. Ports became predictable. Global trade skyrocketed because businesses could finally count on consistent, reliable performance.

Your company’s hidden volatility problem

Right now, your organization likely looks like shipping before containers: high monthly cash flow volatility with occasional catastrophic drops from cyberattacks, fires, supply chain disruptions, or market shocks. There’s growth, yes, but it’s riding on a roller coaster of unpredictable risks.

The transformation opportunity: Risk management’s true purpose isn’t creating policies or filing reports. It’s moving your company from chaotic volatility to predictable performance. When you reduce uncertainty, you attract cheaper capital. Cheaper capital fuels sustainable growth. It’s that simple and that powerful.

The 3 untapped goldmines

Goldmine #1: Insurance that actually reflects your risk

Most companies are dramatically overpaying for insurance because underwriters are pricing imaginary risks, not your actual risk profile.

Consider this real example: Few years ago, our company building a new chemical plant was told by brokers, one of the biggest, that insurance rates would increase by “only” 5% – presented as a victory. But when my risk team analysed the actual exposure and communicated the risk profile directly to underwriters, we didn’t just avoid the increase – we saved 26%, worth $2.7 million. One month work.

Moving beyond qualitative risk descriptions to quantitative risk modelling. When you can demonstrate your loss exceedance curves and calculate fair insurance costs, you’re not just buying coverage – you’re negotiating from a position of knowledge and strength.

Goldmine #2: Operational loss reduction

Every department in your organization is bleeding money through preventable losses: bad debts in sales, supplier claims in procurement, environmental fines, unplanned maintenance downtime, product returns and refunds.

These aren’t inevitable business costs – they’re risk management failures. Each represents a pattern of misunderstood or mismanaged uncertainty that’s creating cash flow volatility.

Goldmine #3: Decision support

This is the big one. Every significant choice your organization makes – from new building locations to contract negotiations – involves complex risk trade-offs that are currently analysed through executive intuition rather than rigorous risk assessment.

Should you build next to existing plant to save on piping costs, even if it increases fire exposure and business interruption risk? What’s the real cost difference when you factor in insurance implications? Without proper risk analysis, these million-dollar decisions are essentially educated guesses.

Pillar 1: From deterministic to stochastic thinking

Your business plans assume single forecasts, single scenarios, single inflation rates. Reality operates in volatile ranges, not fixed points.

The transformation begins by introducing uncertainty into planning conversations. What’s the confidence level in this forecast? What if foreign exchange doubles due to geopolitical conflict? What contractual protections exist if demand varies by 50%?

This isn’t about creating more pessimistic scenarios – it’s about making uncertainty visible so it can be managed intelligently.

Pillar 2: New risk language

“We can’t share loss data – it’s confidential.” This bs response has blocked quantitative risk management for decades.

Enter SIPmath standard, a mathematical language that preserves complete confidentiality while enabling sophisticated risk analysis. You can transfer risk information between departments, clients, and vendors without disclosing sensitive underlying data.

More importantly, SIPmath integrates directly into Excel, R, Python, transforming ordinary spreadsheets into risk models that anyone can use. Your finance team’s budget becomes a risk assessment. Your project manager’s timeline becomes a probability distribution. Your strategy team’s forecasts become scenario analyses.

Pillar 3: AI agents at scale

Artificial intelligence isn’t replacing risk managers – it’s multiplying their impact by 5-10x. AI agents can identify risks, research exposures, draft mitigation strategies, and support risk analysis across contracts, projects, and decisions that would previously require weeks of human effort.

The result? Risk analysis for every significant decision, not just the few that rise to executive attention.

The future is already here

Companies implementing decision-centric risk management aren’t just improving compliance scores or updating risk registers. They’re fundamentally transforming their performance volatility, accessing cheaper capital, and achieving more predictable growth even in uncertain times.

The shipping container proved that simple innovations can create trillion-dollar transformations. The same opportunity exists in risk management today – for organizations bold enough to abandon checkbox compliance in favor of decision-quality improvement.

Your organization can continue managing risks the old way, sustaining unnecessary volatility and overpaying for protection you don’t need. Or you can become the container ship in a world of traditional cargo vessels—faster, cheaper, more predictable, and positioned for exponential growth.

The choice is yours. But remember: while you’re deciding, your competitors might already be building their containers.

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

Continue reading

Two years ago, I realized something that made me uncomfortable: every time I tested a public AI tool on risk management questions, it gave me terrible advice. Not just unhelpful. Actively bad.

I’d ask ChatGPT about risk matrices, and it would enthusiastically explain their benefits. Claude would walk me through implementing enterprise risk management frameworks. Gemini would help me build risk appetite statements. Copilot would recommend colorful heat maps for visualization. All of them were spectacularly wrong. The problem wasn’t that they didn’t know enough. The problem was that they knew too much of the wrong things.

What “Most Probable” Actually Means

Large Language Models work on a simple principle: they predict the most probable next word based on patterns in their training data. But “most probable” doesn’t mean “most accurate.” It means “most frequent.” And what’s most frequent on the internet when it comes to risk management? Thousands of pages explaining how to build risk registers. Hundreds of consulting firm articles about risk appetite statements. Endless templates for heat maps and compliance frameworks. The models are trapped in an echo chamber of popular but deeply flawed practices.

I tested this repeatedly. When I asked about risk matrices, the AIs would initially defend them. Only when I pushed back with specific academic citations would they reluctantly admit the obvious: risk matrices embed dangerous biases and mathematical errors that can lead to terrible decisions. But here’s the thing – most people won’t push back. They’ll take the first answer, assume the AI knows what it’s talking about, and implement advice that feels sophisticated but is fundamentally broken.

Ask RAW@AI about this post or just talk about risk management

Two Worlds, Accelerating Apart

This perfectly captures the split in our profession: RM1 versus RM2. RM1 is the world of artifacts. Policies, registers, appetite statements, heat maps. They satisfy auditors and regulators. They look impressive in board presentations. But they rarely affect how capital actually gets allocated or how strategies get shaped. RM2 integrates quantitative methods into real business decisions. Instead of producing standalone risk reports, it makes planning, budgets, and investments risk-aware. It doesn’t ask “What is our risk appetite?” It asks “How do uncertainties change the choice we’re about to make?”

AI is accelerating the divergence between these two worlds. General-purpose LLMs supercharge RM1. They generate risk registers faster than any human could. They produce polished appetite statements in seconds. They automate compliance reports with ease. But all this paperwork leaves actual decisions untouched.

That’s why I built RAW@AI. Not as another chatbot, but as a specialized tool trained on RM2 principles, grounded in the right sources, and built with guardrails that prevent it from falling into the popular-but-wrong trap. For two years now, my team has used it for actual risk management work – the kind of analysis and decision support that risk teams need to deliver.

The difference isn’t subtle. It’s the difference between astrology and astronomy.

Here’s what worries me: if AI can already produce registers and policies faster than any human, what’s left for risk managers to do? The answer is interpretation. Turning probabilistic models into business insight. Embedding uncertainty into strategic conversations. Making risk analysis a driver of decisions, not just a compliance exercise. The risk manager of the future isn’t a custodian of documents. They’re an architect of decisions. But you can’t get there by asking ChatGPT how to manage risk. You’ll just get a faster way to do what doesn’t work.

I published a benchmark in August 2025 testing major LLMs on risk management questions. The results were clear: none of them were fit for purpose. Although thinking models are getting better.

That should worry every risk professional who’s thinking about using AI in their work. Generic AI doesn’t just give poor risk advice – it amplifies the worst practices in our field while giving users the illusion of sophistication. It makes mediocrity feel modern. And in risk management, mediocrity isn’t harmless. It costs money. It misallocates capital. It builds overconfidence in decisions that should be questioned. The choice isn’t whether to use AI. The choice is whether you settle for tools that reinforce what’s popular, or insist on tools that deliver what’s correct. Because there’s a difference. And in our profession, that difference is measured in millions.

Explore the results of the Risk Benchmark: https://benchmark.riskacademy.ai

Meet RAW@AI, specialized AI for risk management: https://riskacademy.ai

See how AI is transforming RM2 at Risk Awareness Week 2025, 13–17 October: https://2025.riskawarenessweek.com

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

Continue reading

Large corporations face a paradoxical crisis: 90% of buildings are underinsured while simultaneously overpaying for coverage, according to Kroll’s 2021 appraisal study. This represents a $221 billion annual global property protection gap (Swiss Re) occurring alongside systematic overpayment driven by pricing inefficiencies, with leading insurers achieving 47% loss ratios versus 73% for laggards—a 26-percentage point efficiency gap that reveals massive market dysfunction (PwC 2014-2018). The evidence demonstrates that corporations are both bleeding capital through excessive premiums AND exposed to catastrophic coverage gaps, creating what McKinsey calls “inefficient use of resources” totaling $160 billion in potential efficiency gains.

This market failure manifests across all major commercial insurance lines. Property insurance costs nearly doubled from 2013-2023 (75% increase per Deloitte), while 68% of buildings remain underinsured by 25% or more. Liability lines show combined ratios exceeding 110%, meaning insurers lose money on every dollar of premium—losses passed to buyers through pricing volatility. Workers’ compensation exhibits a stunning 70% overpayment rate due to classification errors. The fundamental dysfunction: information asymmetries, operational inefficiencies costing $17-32 billion annually, and broker conflicts of interest have created markets where price bears little relationship to risk.

Severe underinsurance despite escalating premiums

The property insurance market demonstrates the paradox most acutely. Commercial property insurance premiums increased 20.4% in Q1 2023—the highest rate in over 20 years—while Kroll’s analysis of 2020-2021 property appraisals found that 90% of buildings were underinsured, with 68% showing coverage gaps exceeding 25%. Industry experts report that quoted sums insured often represent only 60% of actual insured value (Gen Re 2020). In Germany, average underinsurance approximates 20% according to insurance specialists. This isn’t isolated to small players: recent industry research identified insurance-to-value calculation errors producing coverage gaps exceeding 30% even for sophisticated corporations (CBIZ 2024).

The financial exposure is staggering. Swiss Re’s 2015 Sigma Study documented a $221 billion annual global property protection gap, with $153 billion derived from natural catastrophe underinsurance. Over the past decade, natural disasters caused $1.8 trillion in global property damage with 70% uninsured—representing a $1.3 trillion shortfall. The 2021 Colorado Marshall Fire demonstrated this acutely: 67% of affected homes were underinsured, creating an estimated $155 million gap from just 951 total loss claims. When Hurricane Harvey struck Houston, less than 20% of at-risk homes carried flood coverage. California’s 2018 wildfires saw 80% of properties underinsured, with 60% severely underinsured.

Ask RAW@AI about this post or just talk about risk management

Despite these massive coverage gaps, corporations are paying historically high premiums. Commercial property costs climbed from $1,558 per building monthly (2013) to $2,726 (2023)—a 75% increase—and Deloitte projects costs reaching $4,890 per month by 2030, representing an additional 79% increase. Construction cost inflation drove material costs up 40% from pre-2020 levels, but pricing adjustments have created a market where corporations simultaneously overpay relative to efficient pricing benchmarks while maintaining grossly inadequate coverage limits. The U.S. P&C industry posted $21.2 billion in underwriting losses in 2023 despite these premium increases, indicating systematic pricing dysfunction rather than mere underpricing.

Broker commissions and distribution costs drive overpayment

Property and casualty broker commissions consume 17.5-25% of property insurance premiums, with total commission structures potentially increasing costs by up to 40% when broker fees combine with standard commissions. Major insurers like Chubb pay contingent and supplemental commissions ranging from 0% to 13.4% on top of base commissions. Australia’s CHOICE organization documented commercial insurance brokers and managers collecting $137 million in 2020, up from $82 million in 2016—a 67% increase in four years.

This distribution system creates perverse incentives. McKinsey’s 2025 analysis found that 60% of insurer performance is driven by operations, only 40% by market positioning, suggesting significant operational inefficiency across the industry. Academic research shows that small employers lack expertise and leverage to negotiate effectively, while large employers outsourcing to consultants “do not realize the full gains from negotiating lower prices” (CBO 2023). The U.K. presents a striking paradox: brokers place 94% of all commercial insurance premiums, yet the 80% underinsurance figure persists (Consumer Intelligence), indicating “friction in the advisory process” where the primary defense against underinsurance is failing.

Distribution inefficiency manifests in direct overpayment. One JP Morgan analysis cited broker experience showing a client who compiled comprehensive property documentation reduced their renewal increase from 45% to 3-4% through detailed negotiation. This 41-percentage point differential reveals how information asymmetry and negotiating leverage create massive price variation for identical risks. Commercial insurance administrative costs run 24-33% of premiums versus under 10% for public programs, representing 14 times higher administrative costs than Medicare per dollar of claims (1988 study, ratios persist today).

Property insurance pricing shows extreme geographic and temporal variation

Market rate variations demonstrate pricing inefficiency unrelated to underlying risk. Marsh’s Global Insurance Market Index showed U.S. property rates declining 9% in Q2 2025, while casualty rates simultaneously increased 9%—divergent trends suggesting market dynamics rather than loss experience drive pricing. Quarter-over-quarter volatility is extreme: Q1 2023 saw 17% increases, Q4 2024 showed 5.45% decreases. Geographic variations are equally stark: Florida homeowners pay average premiums of $6,000 annually versus the U.S. average of $1,700—a 253% premium—while states with highest expected losses saw commercial costs increase 108% over five years compared to 96% for lower-risk states.

This pricing volatility creates the overpayment-underinsurance paradox. During hard markets, premiums spike far beyond loss trends, but corporations often respond by reducing limits or increasing deductibles rather than maintaining adequate coverage. During soft markets, premiums decline but coverage gaps persist because corporations fail to restore previous limits. A client achieving a 42-percentage point reduction through negotiation demonstrates that prevailing market prices often bear little relationship to actuarially fair premiums.

Reinsurance cost pressure exacerbates primary market inefficiency. Global property catastrophe reinsurance rates increased 37% in January 2023 renewals—the largest increase since 1992. Florida property catastrophe reinsurance saw 25% midyear 2022 increases. Reinsurance costs jumped 30.1% in 2023, double the prior year’s 14.8% increase. These costs flow through to primary buyers, but the relationship between reinsurance pricing and individual corporate property risk is indirect and opaque, creating cross-subsidies where efficient risks overpay to support inefficient market pricing.

Liability insurance shows systematic underpricing alongside selective overpayment

General liability, professional liability, and product liability lines all demonstrate pricing dysfunction, though the specific manifestations differ. The NAIC’s 2023 report documents an overall P&C industry combined ratio of 101.5%, meaning insurers paid $1.015 in losses and expenses for every $1.00 in premium. “Other liability” (encompassing general liability, E&O, cyber, and umbrella) showed a combined ratio of 110.1% in 2024, representing a 10.1-cent loss per premium dollar. This marks 7.8 percentage point deterioration from 2023’s 102.3% ratio and represents the highest level since 2016.

PwC’s landmark performance measurement study (2014-2018) revealed the true scale of pricing inefficiency: leading insurers achieved 47% average loss ratios while lagging insurers posted 73% loss ratios—a 26-percentage point gap. Leading insurers also maintained 24% expense ratios versus 32% for laggards. Most tellingly, leading insurers achieved these superior results with lower investment returns than competitors, demonstrating that operational excellence and pricing discipline—not market positioning—drive profitability. The study found leaders operate at 54% underwriting beta (volatility) versus 129% for laggards, contradicting the traditional “high risk, high reward” thesis. This suggests that pricing inefficiency allows superior operators to select better risks at adequate prices while inefficient operators overpay for risk or systematically underprice coverage.

Commercial auto liability provides the starkest evidence of systematic mispricing. The line posted a 113.3% combined ratio in 2023, representing 14 consecutive years of underwriting losses totaling $3.3 billion in 2022 alone. Loss ratios climbed from 66.55% (2021) to 77.63% (2024), with average loss severity doubling from 2015-2024 at 8% annual increases—well above 3% economic inflation. Despite 46 consecutive quarters of rate increases through Q4 2023, the line remains deeply unprofitable. This persistent underperformance indicates insurers systematically fail to price social inflation and nuclear verdict trends, yet continue writing business at inadequate rates. Corporations paying these inadequate premiums receive a false sense of security while building up unrecognized liability exposures from insurers’ adverse reserve development.

Massive underinsurance exists despite high liability premiums

73% of companies operate while underinsured according to Hub International’s 2025 North American Outlook Report. This underinsurance manifests through systematic coverage gaps in standard commercial general liability policies. Standard CGL policies exclude 15+ major risk categories including catastrophic risks, pollution liability, cyber liability (despite increasing digital operations), professional errors, product recalls, PFAS contamination, and sexual abuse/human trafficking exposures. These exclusions leave corporations exposed to losses that far exceed insured amounts.

Product liability demonstrates the paradox most clearly. Product contamination and recall insurance represents an estimated $500 million market while product liability insurance totals $3.3 billion—meaning companies buy six times more bodily injury coverage than first-party recall coverage despite recall costs typically being materially larger than injury claims. The average food recall costs $10 million in direct costs excluding brand damage (2012 FMI/GMA study), yet the recall insurance market remains tiny. Real-world examples prove the point: the 2009 peanut recall caused $1 billion in industry losses; the 2018 romaine E. coli outbreak cost $280-350 million; the 2019 Blue Bell listeria incident resulted in $19.35 million in criminal fines, 2,850 lost jobs, plus a $60 million uninsured D&O settlement.

FDA food recalls saw units impacted increase 700.6% from 2021 to 2022 (52.1 million to 416.9 million units), yet product recall insurance purchases haven’t kept pace. Insurance brokers and retail agents represent a “major failure point” as product recall insurance isn’t covered on most standard agent license exams, leaving many unfamiliar with coverage. This systematic distribution failure means corporations unknowingly operate with massive first-party recall exposure while paying premiums that reflect third-party injury risks.

Professional liability and D&O insurance show similar gaps. Medical professional liability market premiums shrank 2% over a 10-year period (2013-2023) despite healthcare expenditures increasing 50%, creating systematic underpricing and market exit. Professional liability policies’ claims-made structure creates coverage gaps when policies lapse or companies switch carriers without tail coverage. Many professionals carry minimum limits ($250K-$1M) insufficient for major claims while settlements and judgments rise faster than typical coverage limits.

D&O insurance pricing volatility demonstrates extreme market dysfunction

Directors and officers liability insurance experienced the most dramatic pricing swings of any commercial line. Premiums reached 4.7x their Q1 2018 levels by Q1 2021, then collapsed to 1.9x 2018 baseline by Q2 2024—a 60% decline from peak in just three years. This 370% swing demonstrates extreme market inefficiency driven by capital flows rather than loss experience. The hard market of 2020-2021 saw average quarterly rate increases of 14%, with small/mid-cap companies and IPO/SPAC entities experiencing even steeper increases. Companies paid historically high premiums during this period yet faced coverage restrictions, higher retentions, and narrower terms.

The subsequent soft market beginning in 2023 saw average rate changes plummet to 0.1% quarterly, with 68% of renewals receiving price decreases averaging 9.7% by 2024. Yet securities class action filings increased 10% in H1 2024 to 104 cases, putting the year on track to exceed 200 filings for the first time since 2020. Half of cases from the past five years remain open, creating latent liability. TransRe’s analysis warns that “today’s U.S. public D&O insurance market is, in the aggregate, unprofitable” with high excess layers only up 6.6% since 2013 while the S&P 500 more than tripled. Legal service inflation runs 8.3% (2024) versus a 4.3% average from 2015-2024, yet pricing declined 3.9% in Q4 2024.

This pricing cycle demonstrates the overpayment-underinsurance paradox perfectly. During the hard market peak, companies paid maximum premiums while accepting higher retentions ($1-10M for larger buyers), narrower coverage, and stricter terms—simultaneously overpaying relative to efficient pricing while underinsured relative to exposures. As the market softened, new capacity entered chasing returns, driving prices down regardless of underlying loss trends. AM Best’s 2024 analysis found direct monoline D&O premiums declined 12.7% year-over-year despite a 51.5% loss ratio (lowest in nine years), with adverse reserve development from 2017-2020 accident years still uncertain. The dramatic swings and “easy come, easy go” behavior indicate what TransRe calls “irrational group-think” rather than rational pricing based on loss experience.

Workers’ compensation overpayment reaches 70% due to classification errors

Workers’ compensation shows a different manifestation of pricing inefficiency: systematic overpayment driven by complexity rather than underinsurance. The Institute of WorkComp Professionals reports that 70% of companies overpay workers’ compensation insurance premiums due to worker classification errors. Given that classification codes determine premiums ranging from $0.30 per $100 of payroll for clerical positions to $30 per $100 for roofers—a 100-fold difference—misclassification creates massive overpayment.

Documented cases include a North Carolina sawmill that overpaid $400,000 over several years, a Colorado healthcare company whose premiums unexpectedly skyrocketed due to misclassification, and an Indiana contractor paying expensive roofing premiums for clerical workers who never worked on construction sites. Construction, agriculture, and staffing services face the highest misclassification risk. Policy-mandated audits sometimes fail to catch overpayments within required 12-month periods, leaving corporations paying excessive premiums for years.

Despite this widespread overpayment, workers’ compensation remains the most profitable major commercial line with a 2024 combined ratio of 88.8% (S&P). The line’s 50.39% loss ratio in 2024 meant insurers paid out only about half of premiums in claims, with the remainder covering expenses and profit. This profitability amid systematic customer overpayment demonstrates pricing inefficiency: insurance should price risk accurately, yet 70% of buyers pay more than actuarially appropriate while insurers earn outsized returns. The market fails to self-correct because classification complexity creates information asymmetry favoring insurers.

Cyber insurance pricing operates without adequate loss data

Cyber insurance faces structural pricing inefficiency: insurers lack sufficient historical incident and claims data to accurately price risk. The Atlantic Council, CISA (2018), RUSI (2021), and GAO (2022) all identified “insufficient historical cyber incident and claims data” as the “chief roadblock to effective cyber insurance.” Oxford Academic’s analysis of filed policies found carriers pricing using “competitive analysis rather than actuarial data”, with one carrier stating: “underwriters collectively have over 40 years’ experience… collective knowledge… was used to establish rates” rather than loss data.

This data deficiency creates extreme pricing volatility. From 2020-2022, cyber premiums spiked dramatically during a ransomware surge. In 2023, rates decreased an average 15% following improved loss experience. By Q4 2024, rates declined 5% as loss ratios remained below 50%, indicating continued profitability despite rate cuts. The market grew from a 26% corporate take-up rate (2016) to 47% (2020), projected to reach $40 billion in global premiums by 2030 from $16.6 billion in 2025 (Swiss Re). Yet only 10% of SMEs carry cyber insurance versus 80% of large corporates, demonstrating massive underinsurance among smaller companies.

Recent incidents prove underinsurance persists even among major corporations. The February 2024 Change Healthcare attack caused a $3.09 billion pre-tax financial impact from failure to implement multi-factor authentication. Only one of three major UK retailers (M&S, Co-op, Harrods) affected by ransomware had cyber insurance. While 1,228 incidents were reported across U.S. clients in 2024 (22% increase year-over-year), 776 cyber claims were filed (one-third increase), and ransomware incidents rose 24%, many corporations remain uninsured or underinsured. Average ransomware payments of $553,959 in Q4 2024 demonstrate meaningful financial exposure, yet the cyber insurance protection gap reaches 99% with 2020 economic losses of $950 billion against only $7 billion in cyber insurance market size (McAfee data).

Loss ratio analysis reveals massive performance variation

NAIC data for 2024 reveals stark performance differences across commercial lines. Fire insurance achieved a 41.27% loss ratio (best in property), allied lines posted 49.13%, commercial multiple peril non-liability showed 49.92%, and inland marine recorded 43.58%. These property lines operate profitably with combined ratios in the 75-85% range. By contrast, liability lines struggle significantly: “other liability” reached 70.77% loss ratios (110.1% combined ratio), commercial auto liability hit 77.63% loss ratios (113.0% combined ratio representing 14 consecutive years of losses), and products liability posted 52.46% loss ratios (99.8% combined ratio showing 10.3-point year-over-year deterioration).

The performance gap between leading and lagging insurers dwarfs line-of-business differences. PwC’s study documented leaders achieving 47% loss ratios with 24% expense ratios (71% combined ratio) versus laggards’ 73% loss ratios and 32% expense ratios (105% combined ratio)—a 34-percentage point combined ratio differential. Leaders achieved this while maintaining lower volatility (54% underwriting beta versus 129% for laggards) and generating lower investment returns, proving operational excellence drives results rather than risk-taking or favorable market conditions.

Among the top 20 commercial auto insurers in 2024, 14 posted combined ratios exceeding 100%, with worst performers ranging from 123-130% (Sentry at 130.0%, Chubb at 126.2%, State Farm at 123.6%) while best performers achieved 88-92%. This 40+ percentage point variation for similar coverage demonstrates that pricing inefficiency creates winners and losers independent of underlying risk. Swiss Re documented $16 billion in adverse reserve development for commercial liability lines in 2024 alone, with $62 billion over the past decade—equivalent to damages from two major hurricanes. This systematic reserve inadequacy indicates the industry chronically underpriced long-tail liability risks while individual buyers experienced vastly different outcomes based on insurer selection.

Social inflation drives liability costs far beyond premiums

Swiss Re’s 2023 analysis found commercial liability costs rising 16% annually (five-year average) while economic inflation ran only 3%—a 13-percentage point social inflation premium. AM Best’s commercial auto analysis documented average loss severity doubling from 2015-2024 with 8% annual increases versus 3% economic inflation. “Nuclear verdicts” exceeding $10 million drive unpredictable costs, with large verdicts creating precedent that leads plaintiffs in other cases to seek similar awards, “quickly making existing reserves inadequate.”

Third-party litigation funding, proliferating legal advertising, and anti-corporate sentiment in jury verdicts all contribute. Yet insurers systematically fail to price these trends adequately. Commercial auto liability endured 46 consecutive quarters of rate increases through Q4 2023 yet remained deeply unprofitable with $6.4 billion in losses from the liability component alone in 2024 (partially offset by $1.5 billion profit from physical damage). Products liability saw 10.3-point combined ratio deterioration year-over-year, approaching unprofitability despite premium increases. “Other liability” deteriorated 7.8 points from 2023 to 2024, reaching its worst performance since 2016.

This creates a pernicious cycle: insurers underprice social inflation, suffer losses, then spike rates during hard markets before competitive pressure forces rates down again. Corporations caught in hard markets overpay relative to efficient pricing while those renewing during soft markets appear to underpay, yet both face underinsurance relative to true exposure because social inflation means existing limits become inadequate faster than corporations adjust coverage. The $62 billion adverse development over a decade suggests corporations collectively purchased $62 billion less coverage than needed, yet many simultaneously overpaid relative to insurers’ cost structures.

Consulting firms document $160 billion efficiency opportunity

Major consulting firms have extensively documented commercial insurance market inefficiencies. Accenture’s 2022 study found $170 billion of insurance premiums at risk over five years from poor claims experiences, with 31% of claimants not fully satisfied, 30% of dissatisfied claimants switching carriers, and 47% considering switching. The firm identified $160 billion in potential efficiency gains from underwriting improvements by 2027, noting that up to 40% of underwriter time is spent on non-core administrative activities. This translates to annual efficiency losses of $17-32 billion from underwriting inefficiency alone.

McKinsey’s analysis revealed that the average insurance company destroyed $27 million in economic profit annually from 2013-2017 while the top quintile captured all industry economic profit averaging $764 million per year. Industry cost ratios increased approximately 10% from 2012-2017 despite rising labor productivity, with the gap between leaders and laggards widening substantially. Bottom-quartile insurers primarily drove cost inefficiency expansion. McKinsey found that most global insurance carriers failed to generate value even before the pandemic, with markets becoming problematic as insurers “sacrifice long-term profits for short-term growth” through price wars and aggressive competition.

BCG’s research documented that “there is no good price for a bad risk” in current environments where catastrophe loads leave less margin for attritional losses. The firm noted carriers hindered by siloed operations, uncoordinated processes, and legacy technology debt face significant challenges. Only 33% of insurers report advanced use of automation, AI, and data analytics in pricing, with most historically struggling to incorporate price sensitivities and customer behavior. Deloitte’s analysis found the 80% underinsurance figure persists despite brokers placing 94% of commercial premiums, indicating “friction in the advisory process” potentially caused by brokers being “stretched by regulatory burdens.”

Academic research confirms information asymmetry and market failures

Nobel Prize-winning foundations by Arrow (1963), Akerlof (1970), and Rothschild & Stiglitz (1976) established that asymmetric information creates market failures in insurance, with competitive forces potentially failing to push toward efficiency in large, important markets. Einav, Finkelstein, and Levin’s empirical work found that multidimensional heterogeneity—consumers differing in both risk AND preferences—creates complex dynamics where lower-risk individuals may be more risk-averse, creating offsetting self-selection patterns that standard adverse selection models miss.

Harvard’s Kong, Layton, and Shepard study identified a large “selection wedge” of 20-30% of average costs driven by information asymmetry. They found that “adverse selection pushes firms toward aggressive price cutting to attract price-sensitive, low-risk consumers, creating a wedge between average and marginal costs that limits how many firms can profitably survive.” Without corrective policies, this can “unravel the market to monopoly”—an “un-natural” monopoly driven by information problems rather than efficiency. Interventions limiting price-cutting can improve welfare by supporting more entry and ultimately leading to lower prices through competition.

Duke University’s Rampini research documented the “risk management paradox”: financially constrained firms that could most benefit from insurance hedging lack resources to purchase adequate coverage. Financial constraints simultaneously serve as both the reason firms should hedge and the reason they don’t. When income drops, people reduce insurance despite being more financially constrained and needing protection more, because insurance requires premium payments today for uncertain future benefits. This explains why 73% of companies operate underinsured even while many overpay: constrained firms reduce limits to afford premiums, while inertia-bound customers maintain expensive legacy coverage without optimizing.

Commercial insurance prices show healthcare-parallel inefficiency

Congressional Budget Office analysis of healthcare provides instructive parallels to commercial insurance. CBO found that “price variation among commercial insurers greatly exceeds price variation in Medicare fee-for-service,” suggesting “market inefficiency, including the ability of some providers to command prices far exceeding their costs.” Commercial insurers pay 2.4x Medicare rates for hospital outpatient services, 1.8x for inpatient services, and 1.3x for physician services overall. Price growth from 2013-2018 ran 2.7% annually for commercial insurers versus 1.3% for Medicare—one percentage point above inflation.

Academic research shows “strong positive relationship between market concentration and prices paid by commercial insurers,” yet 30% of high-priced hospitals operate in unconcentrated markets, suggesting pricing power sources beyond market share. Small employers lack expertise and leverage to negotiate effectively; large employers outsourcing to consultants “do not realize the full gains from negotiating lower prices.” Limited antitrust enforcement compounds the problem: from 2010-2018, antitrust agency appropriations declined in real terms while merger filings increased substantially. Medical loss ratio requirements may perversely incentivize higher spending rather than efficiency, similar to expense structures in P&C insurance.

Commercial insurance administrative costs of 24-33% of premiums (versus under 10% for Medicare) mirror the healthcare findings. This represents 14 times higher administrative costs than Medicare per dollar of claims based on 1988 research, with ratios persisting in modern markets. The 1988 study estimated $13 billion could be saved if efficient programs replaced commercial insurers—equivalent to multiples higher today. Insurance markets exhibit what behavioral economics research calls “anomalous behavior” requiring intervention, with demand affected by loss aversion, ambiguity aversion, and cognitive limitations in evaluating complex products.

Catastrophe losses exacerbate property pricing while gaps persist

Natural catastrophe frequency and severity drive property insurance pricing, yet coverage gaps widen. The U.S. experienced 28 separate billion-dollar weather events in 2023 with $92.9 billion in estimated costs—up 56% from 2022 and 180% (10.8% CAGR) over 10 years prior. Since 2017, the U.S. averaged 15 catastrophes exceeding $1 billion annually, up from fewer than 10 per year in the previous decade and fewer than six before 2007. First-half 2023 alone saw $34 billion in insured natural disaster losses, with 68% from severe convective storms. Global 2023 insured losses from natural disasters reached $88-112.5 billion, 17% above average.

These escalating losses drive premium increases, with catastrophe modeling and reinsurance costs flowing through to corporate buyers. Yet the protection gap simultaneously widens. Swiss Re documents a $130-140 billion natural catastrophe protection gap in 2021, with more than 60% concentrated in North America and Europe, mostly attributable to commercial lines. McKinsey notes that commercial P&C premiums as a percentage of GDP declined from 1.8% to 1.6% in North America (more than 10% decline) when adjusted for rate hardening, meaning “commercial P&C lines are losing market relevance” even as premiums grow nominally.

The paradox: catastrophe losses drive rate increases that make coverage less affordable, causing corporations to reduce limits or increase deductibles, which widens protection gaps even as they pay higher absolute premiums. Nine Florida-focused P&C insurers became insolvent since 2021 due to poor market financial performance, forcing the state-run Citizens Property Insurance Corporation to become increasingly vital as private insurers withdraw. This capacity reduction drives remaining market prices even higher while corporations struggle to secure adequate limits at any price. The result is simultaneous overpayment relative to efficient risk pricing and underinsurance relative to actual exposure.

Small and mid-size enterprises face acute underinsurance crisis

While this report focuses on large corporations, SME data illuminates market dynamics affecting all buyers. 75% of U.S. small businesses are underinsured (Hiscox 2023), with 80% of high-growth SMEs underinsured or having wrong coverage (Publicis Sapient). Over 70% of small business owners lack clear understanding of business insurance coverage, with 83% unable to accurately describe general liability and 71% unclear about business owner’s policies. Nearly 70% don’t fully understand their coverage or how it works, while 39% of businesses operating 10+ years have never updated general liability insurance.

McKinsey identified €2 billion in untapped market potential from underinsured SMEs in Germany alone, with only one-third of German SMEs completely satisfied with current coverage (2020). Despite 92% of small businesses having insurance (up from 72% in 2023), only 13% feel completely prepared to face potential threats, with 87% feeling less than fully prepared. The remaining 8% of small businesses stay uninsured primarily due to cost and confusion. This suggests that as companies grow from small to mid-size to large, they carry forward underinsurance patterns established early, never conducting comprehensive coverage reviews.

The data contradicts the assumption that large, sophisticated corporations optimize insurance purchasing. If 75% of small businesses are underinsured and 73% of all companies operate underinsured (Hub International), large corporations clearly aren’t immune despite having more resources for risk management. The 90% building underinsurance rate (Kroll) and persistent 80% underinsurance figure despite 94% broker placement demonstrate that market structure—not buyer size or sophistication—drives dysfunction. Large corporations may have marginally better outcomes but still systematically overpay (through broker commissions, administrative costs, and pricing inefficiency) while maintaining inadequate coverage (through index-linked policies that don’t track true replacement costs, coverage gaps, and failure to adjust limits as exposures grow).

Premium growth massively outpaces loss growth yet gaps persist

From 2020-2024, total P&C earned premiums grew from $717.2 billion to $1,029.3 billion (43% increase) while total losses rose from $429.1 billion to $636.1 billion (48% increase). Loss ratios fluctuated: 59.83% (2020), 62.43% (2021), 67.34% (2022), 65.53% (2023), 61.80% (2024). Combined ratios showed: 99.6% (2020), approximately 100% (2021), 103.1% (2022), 103.7% (2023), 96.5% (2024). The 2024 result marked the best underwriting performance in over a decade, with S&P noting significant improvement from prior years.

Yet this aggregate profitability masks severe line-level dysfunction. Workers’ compensation posted an 88.8% combined ratio (highly profitable), fire insurance achieved 77.2%, and commercial auto physical damage reached 88.6%. These profitable lines subsidize systematic losses in commercial auto liability (113.0% combined ratio, 14 consecutive years of losses), “other liability” (110.1% combined ratio, worst since 2016), and products liability (approaching break-even with rapid deterioration). The cross-subsidy means corporations with favorable loss experience in profitable lines overpay to support industry losses in unprofitable lines.

This dynamic explains how overpayment and underinsurance coexist. Premium growth of 43% over four years substantially exceeded loss growth in profitable lines, meaning well-performing risks paid far more than actuarially necessary. These excess premiums funded chronic underpricing in liability lines where combined ratios exceeded 110%. Corporations with good property loss experience effectively subsidized corporations with adverse liability experience, while both groups face underinsurance: property risks through inadequate limits relative to replacement costs, liability risks through insufficient limits relative to social inflation and nuclear verdict trends. The market’s inability to accurately price and segment risk creates diffuse overpayment funding concentrated underpricing, with coverage gaps persisting across all buyer segments.

Market concentration limits competition while pricing varies wildly

The top 10 P&C insurers control 51.4% of market share (NAIC 2024), with the top 25 holding approximately 67%. State Farm commands 10.23%, Progressive 7.13%, Berkshire Hathaway 5.94%, and Allstate 5.25%. This concentration theoretically provides pricing power, yet performance varies enormously. Progressive Group’s commercial auto loss ratio reached 61.46%, Travelers achieved 54.06% across all lines, and Chubb posted 58.09%, while Berkshire Hathaway recorded 62.07%. These leading insurers significantly outperform industry averages in loss ratios yet charge competitive market rates, suggesting widespread market mispricing.

Market concentration should drive pricing efficiency through economies of scale and data advantages, but evidence suggests the opposite. The 26-percentage point loss ratio gap between leaders (47%) and laggards (73%) from PwC’s study persists despite high concentration, indicating that market share doesn’t translate to pricing discipline. Commercial auto shows 14 of the top 20 insurers posting combined ratios exceeding 100%, with variation spanning 40+ percentage points among major carriers. If markets priced efficiently, such persistent performance gaps wouldn’t exist—competition would force laggards to either improve operations or exit markets.

The persistence of this inefficiency suggests barriers preventing market forces from working. Regulatory requirements maintain insurer solvency rather than operational excellence, allowing inefficient operators to persist. Distribution through brokers creates information asymmetries favoring incumbent relationships over price competition. Product complexity prevents buyers from effectively comparing offerings. Contract opacity makes ex-ante price comparisons difficult while ex-post analysis requires actuarial expertise most corporations lack. The result: large corporations can’t effectively arbitrage pricing inefficiencies even when aware they exist, leaving them simultaneously overpaying (relative to efficient operators’ costs) and underinsured (because pricing volatility discourages maintaining optimal limits through market cycles).

Evidence synthesis reveals structural market failure

Synthesizing evidence across all research domains confirms the hypothesis that large corporations systematically overpay for insurance while remaining underinsured. Property insurance shows the clearest patterns: costs increased 75% (2013-2023) while 90% of buildings are underinsured with 68% showing gaps exceeding 25%, creating a $221 billion annual global protection gap. Broker commissions consume 17.5-25% of property premiums, with total distribution costs reaching 40%, while administrative expenses run 24-33% versus under 10% for public programs. Corporations paying these elevated costs still maintain coverage representing only 60% of actual insured value, with insurance-to-value errors exceeding 30%.

Liability insurance demonstrates overpayment through combined ratios exceeding 100% (meaning insurers systematically underprice, then correct through rate spikes during hard markets), with 26-percentage point loss ratio gaps between efficient and inefficient insurers revealing that many corporations overpay relative to best-practice pricing. Yet 73% of companies remain underinsured, with product recall insurance markets totaling one-sixth of product liability markets despite recall costs materially exceeding bodily injury costs. D&O premiums spiked 370% then fell 60% in six years—volatility unrelated to fundamental loss trends—while securities litigation increased. Workers’ compensation sees 70% overpayment from classification errors while maintaining 88.8% combined ratios showing systematic overpricing relative to losses.

The mechanisms driving this paradox include: (1) information asymmetry preventing accurate risk assessment and creating adverse selection dynamics, (2) broker conflicts of interest and distribution inefficiencies consuming 30-40% of premiums without corresponding value creation, (3) product complexity preventing effective comparison shopping, (4) pricing volatility incentivizing corporations to reduce coverage during hard markets without restoring it during soft markets, (5) adverse reserve development of $62 billion over a decade proving systematic underpricing that ultimately flows back to buyers through rate corrections, and (6) social inflation and catastrophe trends outpacing pricing adjustments, creating underinsurance even for corporations paying elevated premiums. The $160 billion efficiency opportunity Accenture identified, combined with McKinsey’s finding that average insurers destroy $27 million annually in economic profit, demonstrates that market dysfunction creates dead-weight losses harming both buyers and efficient operators while allowing inefficient insurers to persist through pricing complexity and regulatory protection from market forces.

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

Continue reading

For years, I sat through risk management conferences that made me want to leave the profession. The pattern was always the same. Sponsors paid for booths. Sponsors got speaking slots. And suddenly the agenda was full of presentations about software features or broker nonsense that had nothing to do with making better decisions or risk management. The content was empty. The travel was exhausting. And I kept thinking: why does it have to be this way?

I didn’t want to travel anyway. And the whole model felt backwards – the sales people funding the event controlled what got discussed, which meant the conversations we actually needed to have never happened. The solution seemed obvious: take it online. Cut out the sponsors. Fund it myself. Talk about what actually works. The problem was finding technology that could handle it. For years, I looked for a platform that wouldn’t cost a fortune and could actually deliver a good experience for thousands of people. In 2019, I finally found one – a startup that had built exactly what I needed.

So I reached out to the people I’d been learning from. Doug Hubbard. Norman Marks. Sam Savage. Grant Purdy. The experts who understood that risk management wasn’t about maintaining registers or filling out heat maps. The ones who’d been teaching RM2 before I called it RM2. I asked them to speak. They said yes.

Risk Awareness Week launched in October 2019. Over 3,000 people from 120 countries showed up. I was stunned.

Ask RAW@AI about this post or just talk about risk management

I never thought of RAW as “my” conference. From day one, it was something else – a gathering place for people who knew the traditional approach wasn’t working but had nowhere to build an alternative. We didn’t talk about ERM, GRC, ESG. We didn’t pretend that scoring systems could turn subjective judgment into objective data. We didn’t follow frameworks just because a standard said we should. Instead, we focused on probability, decision science, evidence, and results that could be measured. RAW became what I can only describe as a refuge. Not in the sense of hiding, but in the sense of having space to question things without being told you’re not a “real” risk professional. A place where your ideas had to hold up on their merit, not on your job title or the size of your company.

What surprised me was how hungry people were for this. They came back. They brought colleagues. They shared case studies with actual numbers: cutting insurance costs by 60% while tripling coverage, saving $3 million through proper risk analysis. Not theoretical improvements. Real money. Real decisions. Six years later, the numbers tell a story I didn’t expect: more than 20,000 participants, over 270 workshops, speakers who return year after year because the conversation matters to them. Our YouTube channel has most of the workshops available for free – we hit the Silver Play Button threshold, which still feels surreal – because I never wanted knowledge to be locked behind paywalls.

In 2024, FERMA named RAW the Training & Education Programme of the Year. What mattered to me wasn’t the award itself, but what they recognized: that we were teaching practical skills people could use immediately. No elaborate frameworks. Just decision science that works. That same year, I launched RAW@AI. I taught it using everything we’d built – my articles, our videos, all the workshops. In its first three months, it supported over 50,000 risk analyses across dozens of countries. The idea was simple: make structured risk management accessible to anyone making decisions, without needing consultants or expensive software.

Here’s what I’ve learned: things survive when they prove themselves useful. Ideas that work take root. Ideas that don’t, fade away. RM2 has survived because it delivers results. RAW has survived because it gave RM2 somewhere to grow – not through credentials or marketing, but through people applying the ideas, seeing what happened, and coming back to share what they learned. The risks we’re dealing with now are more tangled than they were six years ago. More interconnected. Crises emerge from places nobody’s watching. Old solutions fail more frequently. Which means we need spaces like RAW more, not less. It’s not really a conference anymore. It’s become something closer to infrastructure – a place where the profession can test ideas, learn from what works, and keep moving without being chained to “how we’ve always done it.”

I hate using the word “ecosystem” because it sounds like business jargon. But the concept fits: RAW works because people find value, contribute what they’ve learned, and the whole thing adapts and grows. Not by design, but by natural selection. As long as we stay focused on what actually works – not what sounds impressive in a presentation or looks good in a framework – this will keep going.

Risk Awareness Week 2025 runs 13–17 October. Full program and registration: https://2025.riskawarenessweek.com

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

Continue reading

Grant Purdy helped write the book on risk management – literally. He co-authored ISO 31000, the global standard everyone follows. After 50 years in the field, he’s saying something uncomfortable: we got it wrong.

Here’s what he means. Walk into most companies and you’ll find risk registers nobody reads, heat maps that annoy everyone, and processes that measure everything except what actually matters for business decisions. The whole system was supposed to help people make better choices when things are uncertain. Instead, it became a compliance monster that eats time and money while creating fake confidence.

How we ended up here

It happened slowly. Every new regulation and “best practice” piled on top of what came before. We kept inventing solutions to fix problems our previous solutions created. Purdy watched it happen from the inside – useful tools turned into paperwork requirements, decision support became regulatory theater. What we promised and what we actually delivered drifted further apart.

The core problem is simple: there are two completely different games being played. One is about creating documents to satisfy external requirements. The other is about actually helping people discuss uncertainty when making real business decisions. These serve different masters – regulators versus the people who actually run things. Most companies got stuck in the first game and forgot about the second.

Ask RAW@AI about this post or just talk about risk management

Why this matters

Not many people can look at their life’s work and say “we were wrong.” That’s what makes Purdy’s message hit hard. He’s not some outside critic – he’s the guy who built the house and is now saying some walls need to come down.

His fix is straightforward but requires a mindset shift. Stop saying “risk management” and start saying “decision support.” Instead of risk registers for reporting, help people make specific choices – what to launch, what to delay, where to add safety margins, what to spend money on.

What this means for you

First, you can stop pretending a stack of documents equals managing uncertainty. Second, bring conversations back to actual decisions – what are our options, what assumptions are we making, what breaks if the world doesn’t behave like we expect? Third, make tools that people actually want to use – quick decision notes instead of endless registers, “what if” scenarios instead of colorful heat maps, simple response rules instead of thick methodology manuals.

The hardest part is breaking old habits. But there’s freedom in stopping the performative busy work and focusing on what actually changes outcomes. That’s the gift in Purdy’s honesty – permission to quit playing “proper risk management” and do what we set out to do in the first place: help people make better decisions when facing uncertainty.

Admitting we got things wrong isn’t defeat – it’s a fresh start. Risk management can finally do what it always promised: not create fake control, but help people choose better.

Grant Purdy’s session “We Got It All Wrong” is at RAW 2025, October 13-17. Full program at https://2025.riskawarenessweek.com

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

Continue reading

Most risk management destroys value. Risk matrices lie to you. ERM frameworks waste time and annoy management. Quarterly risk reports accomplish nothing except satisfying auditors. Your risk register sits in a drawer while critical decisions get made without considering uncertainty. Your insurance department is relying on broker recommendations instead of your risk analysis. Meanwhile, you’re burning budget on GRC software that generates colorful dashboards nobody uses. Stop pretending compliance theater creates value. It doesn’t.

Real risk management happens when your CFO models cash flow scenarios before approving capital allocation. When your supply chain team quantifies disruption impacts before selecting vendors. When your product team stress-tests assumptions against realistic market conditions. Or when you save millions on insurance premiums while doubling and tripling limits and improving the quality of coverage. These are not hypotheticals. These are specific case studies speakers at RISK AWARENESS WEEK  did and willing to share with the risk community.

If you can’t name three specific decisions that improved because of your risk work this quarter, you could be part of the problem. Want to fix this? Join 15000+ risk professionals getting inspired at RISK AWARENESS WEEK 2025: https://2025.riskawarenessweek.com/

Or join me and a select group of professionals to learn how AI can 10X your risk efficiency: https://learn.riskacademy.ai/

Ask RAW@AI about this post or just talk about risk management

Comment RAW and I will send you a PDF guide on 10 Best Risk Management AI assistants. If you haven’t done so already, start using RAW@AI, it has monthly free credits and is used by close to a 1000 risk professionals all over the world: https://riskacademy.ai/

#RiskManagement #DecisionMaking #BusinessValue #RiskAwarenessWeek #RAW2025

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

+ Add to Cart

Continue reading

None of them. And here’s why that should terrify every risk professional.

When you ask ChatGPT about risk matrices, it enthusiastically explains their “benefits.” Claude confidently describes how to implement enterprise risk management frameworks. Gemini cheerfully walks you through creating risk appetite statements. Copilot helpfully suggests using heat maps for risk visualization.

They’re all spectacularly wrong.

Why LLMs give dangerous risk advice

Large Language Models operate on a deceptively simple principle: they predict the most probable next word based on patterns in their training data. But “most probable” doesn’t mean “most accurate” – it means “most frequent.” When it comes to risk management, this creates a catastrophic problem.

Ask RAW@AI about this post or just talk about risk management

The internet is flooded with content about risk matrices, risk registers, and enterprise risk management frameworks. These topics dominate risk management discussions, training materials, and consulting websites. So when you ask an LLM about risk management, it regurgitates the most common approaches – not the most effective ones.

This is like asking for medical advice and getting recommendations for bloodletting because it was historically popular.

The echo chamber effect in action

Consider this telling experiment: Ask any major LLM to critique risk matrices. Initially, most will defend them, explaining their “widespread adoption” and “ease of use.” Only when pressed with specific research citations do they reluctantly acknowledge the mathematical flaws and cognitive biases these tools embed.

Why? Because criticism of risk matrices represents a tiny fraction of online content compared to the thousands of articles explaining “how to build effective risk matrices.” The LLMs are trapped in an echo chamber of popular but fundamentally flawed practices.

Our recently published analysis revealed a startling pattern: when presented with scenarios requiring nuanced risk thinking or even basic risk math, leading LLMs consistently defaulted to the most conventional responses. They recommended compliance-heavy approaches that separate risk management from decision-making, suggested qualitative assessments over quantitative analysis, and promoted ritualistic processes over practical integration.

The real cost of AI-amplified mediocrity

This isn’t just an academic problem. When risk professionals use LLMs for guidance, they’re getting advice that:

• Promotes ineffective practices that consume resources without improving decisions

• Reinforces cognitive biases rather than addressing them

• Separates risk management from the business decisions it should inform

• Creates an illusion of rigor while embedding dangerous mathematical errors

The result? AI is accelerating the spread of RM1 practices – those compliance-focused, documentation-heavy approaches that satisfy auditors but fail to improve actual business outcomes.

The most dangerous aspect of using general LLMs for risk management isn’t just that they give poor advice – it’s that they make users feel sophisticated while implementing fundamentally flawed approaches. When ChatGPT provides a detailed explanation of how to build a 5×5 risk matrix, complete with color coding and probability ranges, it feels authoritative and scientific. Users walk away believing they’ve received cutting-edge AI guidance on risk management. In reality, they’ve just been taught to implement a tool that research shows consistently leads to poor decision-making, misallocated resources, and dangerous overconfidence.

An alternative? Specialized Risk AI

Recognizing this fundamental limitation, we created something different. Rather than relying on general-purpose LLMs trained on popular but flawed risk content, we benchmarked public and specialized models trained specifically on risk principles.

Our free benchmark platform at https://benchmark.riskacademy.ai shows the stark differences between general LLMs and purpose-built risk AI tools. While ChatGPT might recommend creating a risk register, a specialized model asks: “What specific decision are you trying to make, and how can we analyze the uncertainties that matter for that choice?”

A Simple Challenge

Here’s a quick test you can run yourself. Ask your preferred LLM: “My company is considering a major acquisition. How should we approach the risk assessment?”

Watch how it responds. Does it suggest doing risk identification, assessment and mitigation plans? Does it recommend assembling a risk committee to develop qualitative assessments? Does it focus on documentation and reporting structures?

Or does it ask about the specific strategic decision, the key uncertainties affecting deal value, and how to model different scenarios quantitatively before making the choice?

The difference reveals everything.

What risk professionals need

General-purpose AI tools aren’t just inadequate for sophisticated risk work – they’re actively harmful. That is a fact! They amplify the worst practices in our field while making users feel they’re getting cutting-edge advice.

Real progress requires AI tools specifically designed for decision-centric risk management. Tools that understand the difference between managing risks for compliance versus managing risks for better decisions. Tools trained on evidence-based practices rather than popular misconceptions.

The question isn’t which general LLM is best for risk management. The question is: are you ready to move beyond the limitations of popular opinion and embrace AI built specifically for effective risk practice?

Because in a world where AI amplifies whatever is most common, settling for general tools means settling for mediocrity. And in risk management, mediocrity isn’t just inefficient – it’s dangerous.

Find out more at upcoming RISK AWARENESS WEEK 2025. Register today!

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

+ Add to Cart

Continue reading

In a profession dedicated to identifying and managing uncertainty, there exists a puzzling contradiction: many managers actively avoid quantifying the very risks they’re tasked with. You probably know risk managers like that, we all do. While quantitative risk analysis forms the foundation of effective decision-making under uncertainty (see any textbook on decision science), it remains significantly underutilized in corporate risk management. This resistance isn’t merely a preference – it’s creating a dangerous competency gap that undermines the entire purpose of risk management.

When I speak with risk managers across industries, the discomfort becomes palpable the moment quantification enters the conversation. Eyes dart away, shoulders tense, and the discussion quickly pivots to more comfortable topics like risk frameworks or governance structures or, my favourite, the definition of risk. But why this aversion to what should be a fundamental component?

The resistance to quantification isn’t random – it stems from these reasons:

A. The competency deficit

Most risk managers come to the profession from diverse backgrounds – legal, compliance, audit, or operations – where probabilistic thinking wasn’t a core requirement. They’ve built careers crafting policies, facilitating workshops, and maintaining risk registers without ever needing to model uncertainty mathematically.

Ask RAW@AI about this post or just talk about risk management

“I wasn’t hired to be a statistician,” a senior risk manager at a multinational corporation once told me. “My job is to ensure we have the right controls in place and that everyone understands how risks need to be mitigated.”

This sentiment reveals a fundamental misunderstanding of what effective risk management is. Without quantification, how can anyone determine if the “right” controls are in place or if the process is actually managing risk effectively?

B. The fear factor

Behind the avoidance often lies fear—fear of appearing incompetent, fear of challenging established practices, and fear of the unknown. Learning quantitative methods mid-career can be intimidating, especially when one’s identity is tied to being the “risk expert” in the organization.

A risk manager at a manufacturing company confided: “If I start talking about Monte Carlo simulations or probability distributions, executives will expect me to defend the models. I’m not sure I can do that convincingly.”

This vulnerability is understandable but ultimately self-defeating. By avoiding quantification, risk managers are limiting their ability to provide meaningful insights precisely when decisions matter most.

C. The illusion of qualitative

Perhaps the most pervasive justification for avoiding quantification is the belief that qualitative assessments – heat maps, risk registers, and subjective ratings – are adequate substitutes.

“Our industry is too complex for numbers,” or “You can’t quantify everything” are common refrains. While these statements contain kernels of truth, they’re often deployed as shields against learning quantitative methods rather than legitimate methodological concerns.

The reality is that even imperfect quantification typically provides more decision value than purely qualitative assessments. When a risk manager presents a 4×4 heat map with a risk placed in the “high” quadrant, what actionable information does this actually provide? How much is “high”? How confident are we in this assessment? What are the expected and unexpected losses? Can the tail scenario be hedged? How much do we need to reserve to handle the uncertainty? What is the risk-adjusted company valuation? Without quantification, these critical questions remain unanswered.

One useful mental model to introduce is: “if you can imagine different outcomes, you can simulate them.” For instance, even in cases where data is sparse—such as geopolitical risks or early-stage project uncertainties—subject matter experts can estimate plausible ranges. Monte Carlo simulation doesn’t require perfect precision; it requires structured thinking under uncertainty. Quantification isn’t about being exact—it’s about being approximately right, instead of precisely wrong.

Most damaging is how non-quantitative risk management disconnects from actual business decisions. Consider this scenario: A company is evaluating a $50 million investment with uncertain returns and multiple volatile assumptions. The risk manager presents a heat map showing several “red” risks. The decision-makers nod politely but proceed with their decision based on the deterministic financial analysis prepared by the business unit—which likely contains its own implicit and possibly incorrect risk assumptions. The risk manager’s input becomes ceremonial rather than instrumental to the decision because it lacks the quantitative dimension necessary to integrate with financial decision-making.

So, what should I do?

Moving past this resistance requires acknowledging a fundamental truth: quantification isn’t optional in risk management—it’s essential. Without it, risk management becomes merely a compliance exercise disconnected from the actual decisions that determine an organization’s fate. For risk managers looking to bridge this gap, several approaches can help:

• Start small and practical, obvious, I know – Begin with simple quantitative techniques that address immediate business needs. For example, instead of rating a project risk as “high,” estimate a range of potential cost overruns or delays with confidence intervals. This provides actionable insights without requiring advanced statistical knowledge. Calculating high level contingency for a decision or project or department budget is usually an easy place to start.
• Focus on decision support – Position quantification as a way to support better decisions, not as an academic exercise or a goal in itself. Only quantify when it matters, like calculating expected losses on an insurance policy to determine if the price is fair and renegotiate. When stakeholders see how quantitative risk insights improve resource allocation or contingency planning, resistance typically diminishes. Considering the current AI-driven landscape, organizations are more and more embracing probabilistic thinking at the portfolio level—optimizing capital allocation under uncertainty. QRA plays a central role in this shift. It enables not just the assessment of individual risks, but the aggregation of uncertainty across projects, markets, and time. This systems-level view is critical for companies.
• Don’t do it alone – Connect with other professionals who are successfully implementing quantitative methods. Industry associations, online communities, and specialized courses can provide both technical knowledge and moral support during the learning process. Join us at the Quantitative Risk Virtual Summit on 12 June 2025, free limited time registration https://events.teams.microsoft.com/event/a0267764-1ac2-46c8-956b-8d123e56ec11@7a78bd33-d8ac-4a49-bec7-97e770034789 

The risk management profession stands at a crossroads. As artificial intelligence and advanced analytics transform business decision-making, risk managers who continue to avoid quantification risk becoming irrelevant. The core value proposition of risk management—improving decisions under uncertainty—demands quantitative competency. Organizations are increasingly asking: Why maintain a risk function that can’t quantitatively assess the risks that matter most to our decisions and do it before we make the choice?

The good news is that the barriers to learning quantitative methods have never been lower. Online courses, accessible software tools, AI, and a wealth of practical resources make the transition achievable for motivated professionals.

Let’s do it

Considering the current AI-driven landscape, organizations are more and more embracing probabilistic thinking at the portfolio level—optimizing capital allocation under uncertainty. QRA plays a central role in this shift. It enables not just the assessment of individual risks, but the aggregation of uncertainty across projects, markets, and time. This systems-level view is critical for companies.

The shift toward quantitative risk management doesn’t require abandoning qualitative insights—it means enhancing them with risk when decisions demand it. The most effective risk managers integrate both approaches, knowing when each is most appropriate.

For risk managers hesitant to embrace quantification, consider this: Would you trust a financial advisor who refused to discuss numbers? Would you accept medical treatment from a doctor who avoided diagnostic measurements? Risk management without quantification creates a similar credibility gap.

The path forward is clear. By acknowledging quantification as a core competency rather than an optional add-on, risk managers can transform their role from process facilitators to valued decision partners. The question isn’t whether risk managers should quantify risks, but how quickly they can develop the skills to do so effectively.

Having trained hundreds of professionals transitioning into QRA, one can say: the hardest step is beginning. With the right tools, mindset and attitude, any risk manager can evolve into a quantitative thinker—not by becoming a statistician, but by becoming a better advisor.

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

+ Add to Cart

Continue reading

In 1946, mathematicians at Los Alamos developed Monte Carlo simulation to model nuclear reactions under uncertainty. By the 1990s, sophisticated mathematical approaches to risk helped win Nobel Prizes and generate billions in financial markets. In 1998, Long-Term Capital Management (LTCM) showed us the limitations of risk models. Today? Many organizations have reduced risk management to colors on a matrix. This isn’t just academic—it’s costing businesses real money through poorer decisions. I’ve spent a decade helping companies move from ritual back to results, and today I’m sharing what actually works.

From profit calculation to parallel universe

So, how did we get from sharp mathematical tools used to place better bets and safeguard fortunes on risky sea voyages, tools designed explicitly to improve financial outcomes, to a situation where risk management often feels disconnected from the core business of making decisions? The origins were intensely practical. Think about the earliest forms of probability theory applied in gambling houses or by maritime insurers navigating treacherous trade routes. There were no compliance departments demanding risk registers; there was simply the cold, hard calculation of odds and potential losses to make a better wager or set an accurate insurance premium. It wasn’t about documenting risks for posterity; it was about survival and profit, using the best available quantitative methods to understand and navigate uncertainty.

Take those early maritime insurers, for instance. They didn’t just vaguely acknowledge that storms posed a risk to shipping. They actively sought data, however imperfect, on shipping lanes, seasons, vessel types, and historical losses. They used this information to calculate the probability of a ship encountering a catastrophic storm and estimated the potential financial loss if it did. This wasn’t an abstract exercise. The result of these calculations directly determined the premium charged for insuring the voyage. A higher calculated risk meant a higher premium, directly influencing the profitability of the insurer and the cost for the merchant. The quantification wasn’t a sidebar; it *was* the mechanism for making the core business decision – how to price the insurance policy to cover potential losses while remaining competitive. The mathematics served the decision, which in turn served the goal of financial success.

This pragmatic, decision-focused approach naturally found fertile ground in the financial sector. Institutions dealing with investments and loans saw the clear value in using sophisticated mathematical tools to improve their own high-stakes choices. When Harry Markowitz developed Modern Portfolio Theory in the 1950s, later refined into the Capital Asset Pricing Model (CAPM) alongside Merton Miller and William Sharpe – work recognized with the Nobel Prize in 1990 – the objective was clear. These models weren’t theoretical playthings; they provided a quantitative framework for understanding the relationship between risk and expected return, directly informing investment selection and asset allocation decisions. They allowed portfolio managers to make more informed choices about which assets to hold, how to balance risk against potential reward, and how to price financial instruments. It wasn’t perfect – the Long-Term Capital Management crisis in 1998 showed the limitations – but the fundamental principle held: sophisticated quantification was adopted *because* it led to demonstrably better, more profitable strategies. Risk analysis was deeply embedded in the process of making money.

Ask RAW@AI about this post or just talk about risk management

But then, as the concepts of risk management began to filter out from these inherently quantitative domains into the broader world of non-financial corporations and government entities, something started to change. The transition wasn’t sudden, but a gradual drift began. Initial drivers often weren’t purely about improving internal decision-making. Instead, external pressures started to subtly shift the focus. Growing regulatory requirements, like those following major corporate scandals, and demands from stock exchanges for better governance disclosures, pushed organizations to *demonstrate* they were managing risk. The audience for risk information began to include auditors, regulators, and boards, whose primary concern was often compliance and oversight rather than the nitty-gritty of optimizing specific operational or strategic decisions.

Compounding this shift was a perception, particularly in non-financial sectors, that their risks were somehow different – fuzzier, less quantifiable, lacking the hard data seen in finance or insurance. Whether it was strategic uncertainty, operational hazards, or project complexities, the argument often surfaced that these areas didn’t lend themselves easily to the rigorous mathematical approaches used elsewhere. This perceived difficulty, or perhaps a lack of readily available skills or internal demand for quantification, provided a convenient justification for moving towards more qualitative, descriptive approaches. Listing risks, categorizing them broadly, and discussing them in workshops felt more accessible, even if it lacked the direct link to decision metrics that defined early risk management. The focus began migrating from *improving the decision itself* through analysis to *documenting and reporting on risks* as a separate activity.

The critical point being missed was that the original ‘science’ of risk management derived its immense value precisely *because* it was tightly integrated with the objective of making superior choices under conditions of uncertainty. Calculating the odds wasn’t just an interesting mathematical exercise; it was the basis for making a better bet, setting a viable premium, or constructing a more resilient investment portfolio. The power wasn’t inherent in the tools themselves, but in their direct application to improve the quality and likely outcomes of specific, consequential decisions. What happened when this vital, practical link between analysis and action was weakened or even severed? The effectiveness wasn’t merely reduced; the entire purpose began to warp.

The value wasn’t in the *activity* labeled ‘risk management’, but in how that activity directly informed and improved specific choices – a fundamental principle that was becoming increasingly lost in translation.

The rise of the risk ritual

This widespread adoption in non-financial spheres led to a distinct pattern: the creation of specialized risk management departments, the drafting of elaborate risk management frameworks, and the implementation of processes that operated largely in parallel to the core activities of the business. Instead of uncertainty analysis becoming part of how strategy was set, budgets were built, or projects were planned, it became a separate function, often housed in a different part of the organization, using its own unique set of tools and language. This separation was the first crucial step away from the integrated, decision-focused origins. Into this new parallel universe flowed a host of qualitative tools – the now-ubiquitous risk matrices or heat maps, painting risks in shades of red, yellow, and green; the reliance on subjective rankings like high, medium, and low; and the meticulously maintained standalone risk registers, often residing in spreadsheets or specialized software, completely disconnected from the financial models used for budgeting or the Gantt charts used for project scheduling. These tools offered an appearance of structure and control, easily presentable and seemingly straightforward.

But why do these seemingly logical tools often represent a *failure* to genuinely grapple with uncertainty, potentially creating a dangerous illusion of control? The problems run deep. Take the common risk matrix, typically plotting likelihood against impact using numbered scales or categories. As Douglas W. Hubbard pointed out extensively in his work, these matrices fundamentally misuse mathematics. They treat ordinal rankings – where categories represent an order, like 1st, 2nd, 3rd, or Low, Medium, High – as if they were interval data, where the distance between points is meaningful and consistent (like temperature scales). Assigning a score of ‘5’ for impact doesn’t mean it’s precisely five times worse than a ‘1’, nor is the difference between a ‘4’ and a ‘5’ necessarily the same as between a ‘1’ and a ‘2’. Multiplying these arbitrary scores to get a “risk score” compounds the error, leading to fundamentally flawed prioritizations. Resources might be channeled towards risks appearing ‘red’ on the map, while mathematically more significant threats, perhaps rated ‘medium’ on both scales but with a much wider range of potential negative outcomes, are relatively ignored. Furthermore, the reliance on qualitative labels like ‘High likelihood’ or ‘Medium impact’ masks the true nature of the uncertainty. What does ‘High’ probability actually mean – 50%? 80%? 99%? What is the financial range of a ‘Medium’ impact? These vague terms are putty in the hands of pervasive cognitive biases, extensively documented by Nobel laureates Daniel Kahneman and Amos Tversky. Our judgments about likelihood and impact are easily swayed by recent events (availability bias), our tendency to seek confirming evidence (confirmation bias), or how the risk is described (framing effect). These qualitative tools don’t mitigate these biases; they often amplify them, leading to assessments based more on gut feel and psychological distortions than on a rational analysis of potential outcomes.

Consider this common scenario: a major capital project, perhaps building a new factory or launching a significant IT system, is proposed. The initial business case relies on optimistic projections for costs, timelines, and benefits. The decision to approve the project moves forward based largely on these optimistic point estimates. *Separately*, perhaps weeks or months later, a risk assessment workshop is held. Participants brainstorm potential risks, rate them using a standard matrix, and produce a colorful heat map. This document might be presented to a steering committee or leadership team, who glance at the distribution of red, yellow, and green squares. But critically, this risk assessment rarely prompts a fundamental re-evaluation of the project’s core financial assumptions or the initial go/no-go decision. The risk exercise happens *after* the key decision, serving as a documentation step rather than an integral input *before* commitment. The optimistic budget and schedule assumptions remain unchallenged by a formal analysis of their potential variance.

Or think about another familiar scene: a company dedicates significant resources – management time, employee hours, potentially external consultant fees – to conducting annual enterprise risk management workshops. Teams diligently populate risk registers, debate likelihood and impact scores, and assign risk owners. These registers are meticulously updated and reported upwards. Yet, when it comes time for crucial strategic decisions – entering a new market, acquiring another company, significantly changing the business model – the process often relies heavily on senior management’s experience, intuition, or strategic vision, with little reference back to the formalized risk register. Key assumptions embedded within the annual budget, like sales growth forecasts or input cost stability, might be simple single-point estimates without any rigorous analysis exploring the range of potential outcomes or the impact of volatility. The risk management process runs on its own track, consuming resources, while the engine of strategic and financial decision-making runs separately, largely uninfluenced by it.

The direct consequence of this disconnect is the rise of ‘risk theater’ – activities that create the appearance of managing risk but do little to actually improve the quality of decisions made under uncertainty. Valuable resources are channeled into bureaucratic exercises: filling templates, attending workshops, generating reports that satisfy compliance checklists or governance requirements. Meanwhile, the real, tangible threats to achieving objectives – the potential variability in the budget (Budget@Risk), the likelihood of missing key deadlines (Schedule@Risk), the range of possible cash flow outcomes (CF@Risk) – remain poorly understood because the analysis isn’t embedded where it matters, within the planning and decision-making processes themselves. Reporting itself morphs into the primary goal. Success becomes measured by the timely submission of the risk register update or the presentation of the heat map, replacing the original, more difficult objective of integrating uncertainty analysis directly into planning cycles, budget formulation, investment appraisals, and strategic choices *before* commitments are made.

This separation isn’t just inefficient bookkeeping; it actively cultivates an environment where poorer decisions are more likely. Organizations fly partially blind, making commitments based on assumptions that haven’t been adequately stress-tested against the inherent uncertainties of the real world. How can organizations break free from this cycle of performative risk management and return to analysis that genuinely informs choices? The comforting ritual of filling matrices and generating reports satisfies procedural and compliance needs, ticking boxes and providing a superficial sense of assurance. But it fundamentally fails to deliver the crucial insights decision-makers require to truly understand and navigate the complex web of uncertainties they face, ultimately leaving significant value exposed and inviting entirely foreseeable failures. Recognizing this gap between ritual and reality is the non-negotiable first step.

The path from ritual back to reality isn’t adding layers; it’s fundamentally reintegrating uncertainty analysis *before* decisions are made. This makes risk management a tool for achieving objectives, not just documenting fears. Take the first step: Download the ‘Guide to Effective Risk Management 3.0’ for practical steps on integrating risk into decision-making and culture. Explore further resources and connect with peers at RISK AWARENESS WEEK: https://2024.riskawarenessweek.com. Stop performing risk rituals and start making risk-based decisions. What’s one key assumption in your next major decision that needs genuine uncertainty analysis before you commit?

RISK-ACADEMY offers online courses

+ Add to Cart

+ Add to Cart

+ Add to Cart

Continue reading