Considering aggregate portfolio risk is critical for insurance companies—which means it’s important to differentiate between concentration risk and aggregation risk.
Concentration risk is taken on if many entities in your portfolio all share a common dependency, like a third-party vendor. If this third party experiences a cybersecurity vulnerability or incident, it could affect a number of your insureds in a negative way. Aggregation risk, on the other hand, is defined as the financial, resource-based, or reputational impact when a concentration risk leads to an accumulation of losses within your portfolio.
Let’s break that down even further. By not considering aggregation risk in your book of business, you take on the following risk impacts:
- Financial impact: Arguably, this is the most important potential effect, as you may have to pay out claims due to your aggregate risk. And coverable events aren’t just expensive due to the direct costs of a claim (including first- or third-party expenses and damages) but also because of the resources you’ll use in responding to that claim.
- Resource-based impact: If a concentration risk in your organization is large, there’s a good chance other insurers are seeing it as well. The problem is, if a large event takes place, a number of insurance companies could all be reaching out to the same third party—for example, a forensic firm—to help them with all the claims coming in. This could create a systemic issue in the insurance environment.
- Reputational impact: If you handle a claim situation poorly, your brokers and insureds will remember—which will impact your reputation as an insurance company. Similarly, if you experience a significant number of losses due to aggregate portfolio risk, your reputation will also be impacted. Keep in mind that this impact can reach across your insurance companies to other lines of insurance as well.
To understand portfolio aggregate risk, be sure to take the following things into account.
1. Determine which of your service providers have the concentrations of risk you should focus on.
Just because a service provider has high concentration risk with your portfolio doesn’t necessarily mean it’s going to result in a bad situation; that depends on the quality of the service provider. For example, let’s say half of your insureds are dependent on a large, widely known web service provider and the other half are dependent on a smaller, lesser-known web service provider. Using Security Ratings, you could find that the large web services company has a score of 600, while the smaller web service provider has a score of 300. If this is the case, the smaller web service provider is going to give you more concern, as the lower rating may be linked to certain cyber vulnerabilities which could result in future issues for your portfolio. This knowledge can also help you focus your efforts in researching the differences between both service providers in more detail. So even though the larger web services company may be contributing to a concentration risk in your portfolio, it might be better for you to concentrate your efforts on the smaller of the two.
