vaayaa Inclusive Education
Finance risk assessment

Insurance Underwriting, Claims and Reinsurance Risk Assessment: Pricing, Claims Control and Reinsurance Exposure

A worked example of how a general insurance function finds, scores and controls the risks that threaten pricing, claims settlement, reserves and reinsurance recoveries, with owners, warning indicators and escalation rules.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: High to Medium
See the Insurance Underwriting, Claims and Reinsurance course

Executive summary

This assessment shows how a general insurance carrier can find, rate and control the risks that matter most to pricing, claims cost, reserves and reinsurance recoveries. Eight risks were chosen because they are plausible in everyday underwriting, claims and reinsurance work. Pricing error, reserving uncertainty and cyber exposure carry the highest inherent scores, while claims leakage, fraud and counterparty failure are frequent enough to need steady attention. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium once added controls are in place, and none remain above Medium in this example. The first actions are a documented rating basis for out of appetite risks, a standard claims evaluation checklist, call back checks on payment changes and multi-factor sign in. The carrier is a teaching example, so every score illustrates method, not a real business.

Focus area
Insurance underwriting, claims management and reinsurance
Setting
General insurance carrier with a retail and commercial book, in-house claims handling and a reinsurance programme placed with external reinsurers
Method
Five by five likelihood and impact risk register

Scope

This assessment covers underwriting, claims handling, reserving and reinsurance for a general insurance carrier, from risk selection and pricing through claim settlement, reserve setting, recoveries and reporting. It looks at risks to pricing accuracy, claims cost, capital, customer data and legal duties. It does not cover life, health or investment business. Jurisdiction, product mix, systems and reinsurance structure are assumptions made for teaching.

Context

The carrier writes property, motor and liability policies through brokers and direct channels. Underwriters price risks using rating guidelines and a pricing model. Claims handlers assess and settle claims under authority limits, with large losses reviewed by senior claims managers. A panel of reinsurers shares a share of losses under treaty and facultative arrangements. Policy, claims and reserving data sit in core systems, supported by spreadsheets. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to write profitable and fairly priced risks, settle valid claims promptly and accurately, hold adequate reserves, recover reinsurance on time, and meet regulatory and tax duties. The assets in scope are the premium book, reserves, reinsurance recoverables, capital, policy and claims records, customer personal data and the reputation of the carrier. Stakeholders include underwriters, claims handlers, reinsurance staff, the actuarial function, the board, capital providers, policyholders, brokers, reinsurers and regulators. Every risk has one owner role, the head of underwriting and the claims director report to the chief executive each quarter, and the risk function keeps the register current.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 H07
3 Possible Likelihood 3, impact 4, score 12, high: H04 H05 H08 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 3, score 6, medium: H01 H02 H04 H05 H06 H07 H08 Likelihood 2, impact 4, score 8, medium: H03
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Underwriting selection and pricing error 16 High 6 Medium Head of underwriting
H02 Claims leakage and inconsistent settlement 12 High 6 Medium Claims director
H03 Reserving and valuation uncertainty 15 High 8 Medium Appointed actuary
H04 Reinsurance recoverable and counterparty exposure 12 High 6 Medium Reinsurance manager
H05 Claims fraud and misappropriation of payments 12 High 6 Medium Special investigations manager
H06 Conflicts of interest and conduct with intermediaries 10 High 6 Medium Compliance officer
H07 Data quality and cyber exposure in policy and claims systems 16 High 6 Medium Information security manager
H08 Regulatory reporting, tax and governance failures 12 High 6 Medium Head of compliance
H01

Underwriting selection and pricing error

Strategic Before 16 After 6

Risks are accepted outside appetite or priced using weak rating factors, so premiums do not cover expected claims and the book drifts into loss-making segments.

Who or what is affected: Policyholders, capital providers and underwriting staff

Causes

Pressure to grow premium, thin loss data and rating factors used without testing.

Consequences

Underpriced books, adverse loss experience, capital strain and forced withdrawal from a class.

Existing controls

  • Underwriting guidelines set maximum sums insured by class.
  • Referrals above a set limit go to a senior underwriter.

Control gaps

Pricing models are not back tested against actual claims outcomes.

Additional controls

  • Prevent: Require a documented rating basis and peer review for any risk priced outside guideline bands.
  • Detect: Compare written premium and loss ratios by segment each quarter and flag adverse drift.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Head of underwriting Target: Within 60 days Early warning: Loss ratio on a segment moving outside its approved band for two consecutive quarters.
H02

Claims leakage and inconsistent settlement

Operational Before 12 After 6

Claims are paid without adequate evidence, at inflated values or with inconsistent reasoning between handlers, so claims cost rises without a matching benefit to the customer.

Who or what is affected: Claimants, claims handlers and the policyholder base

Causes

Inconsistent assessor judgement, weak evidence standards and high claim volumes.

Consequences

Overpayment, underpayment disputes, complaints and regulatory attention.

Existing controls

  • Claims above a set value need authority from a claims manager.
  • Settlement guidance is kept in the claims manual.

Control gaps

File sampling covers only large claims, so small repeated leakage passes unseen.

Additional controls

  • Prevent: Use a standard evaluation checklist and record reasons for every payment above a threshold.
  • Detect: Sample settled claims each month for overpayment, missing evidence and avoidable delay.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Claims director Target: Within 45 days Early warning: Rising share of claims settled above the reserve estimate without a recorded reason.
H03

Reserving and valuation uncertainty

Financial Before 15 After 8

Claim reserves rest on assumptions about late reported losses, inflation and legal costs that may prove optimistic, so liabilities are understated and results are later restated.

Who or what is affected: Management, capital providers and regulators

Causes

Late reported claims, changing repair and legal costs and reliance on historical patterns.

Consequences

Misstated results, reserve strengthening and capital decisions made on wrong numbers.

Existing controls

  • Reserves are reviewed by the actuarial function each period.
  • Large claim reserves are set by a claims manager and approved centrally.

Control gaps

Past reserve estimates are not compared with final outcomes.

Additional controls

  • Prevent: Document key reserving assumptions with evidence and test a low and a high case.
  • Respond: Hold a review meeting before results are released when development exceeds a set tolerance.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Appointed actuary Target: Within 90 days Early warning: Adverse development on a class above the agreed tolerance in one reporting period.
H04

Reinsurance recoverable and counterparty exposure

Supplier Before 12 After 6

Reinsurers delay payment, dispute wording or fail, so expected recoveries are not received when large losses occur and the net position is larger than the plan assumed.

Who or what is affected: Capital providers, policyholders and the reinsurance team

Causes

Concentration on a few reinsurers, slow loss notices and disputes over treaty wording.

Consequences

Unrecovered losses, capital shortfall and loss of reinsurance capacity at renewal.

Existing controls

  • Reinsurers are chosen against a minimum financial strength criterion.
  • Recoverables are reported to management each quarter.

Control gaps

Reinsurer credit quality is reviewed only at renewal, not during the treaty year.

Additional controls

  • Prevent: Spread cessions across several reinsurers and cap the share with any one counterparty.
  • Detect: Age recoverables monthly and query any balance overdue beyond the agreed period.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Reinsurance manager Target: Within 60 days Early warning: A reinsurer's recoverable balance overdue beyond the agreed period.
H05

Claims fraud and misappropriation of payments

Financial Before 12 After 6

Claims are exaggerated or fabricated, or payments are redirected to altered bank details, so the carrier pays money that is not owed and the loss is hidden inside normal claims flow.

Who or what is affected: Policyholders, honest claimants and the insurer

Causes

Opportunistic exaggeration, organised rings and weak identity checks at first notice.

Consequences

Direct loss, higher premiums for honest customers and internal misconduct cases.

Existing controls

  • Claims above a set value are checked against an investigation database.
  • Payments go only to verified bank accounts held on file.

Control gaps

Analytics run on large claims only, and staff do not record suspicions consistently.

Additional controls

  • Prevent: Verify any change of payee or bank detail by a call to a known contact before payment.
  • Detect: Flag claims with recent policy inception, repeated assessors or shared contact details.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Special investigations manager Target: Within 45 days Early warning: Rise in claims with new payees or changed bank details close to the claim date.
H06

Conflicts of interest and conduct with intermediaries

Reputational Before 10 After 6

An underwriter or adjuster has a personal or commercial link to a broker or claimant, or accepts hospitality that shapes a decision, which weakens fair treatment and trust in outcomes.

Who or what is affected: Customers, brokers and staff

Causes

Long broker relationships, commission incentives and unclear rules on gifts.

Consequences

Biased underwriting or settlement, loss of trust and disciplinary action.

Existing controls

  • Staff sign a conduct code each year.
  • Gifts and hospitality above a set value are recorded.

Control gaps

Declarations are collected but not compared against current assignments.

Additional controls

  • Prevent: Require a written independence check before an adjuster or underwriter accepts an assignment.
  • Respond: Provide a confidential route to raise concerns and log how each one is closed.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest linked to a live claim or to a broker whose business is being rated.
H07

Data quality and cyber exposure in policy and claims systems

Technology and data Before 16 After 6

Phishing, weak passwords and manual copies of policy and claims data expose personal information, while poor master data and manual transfers create wrong payments and wrong reserves.

Who or what is affected: Customers, staff and users of the core systems

Causes

Phishing, reused passwords and spreadsheets copied between teams.

Consequences

Stolen personal data, wrong claim payments, system outage and a regulator notice.

Existing controls

  • Policy and claims systems need individual sign in and are backed up daily.
  • Staff are told not to send policy files by public links.

Control gaps

Spreadsheets used for reserves sit outside the access controls.

Additional controls

  • Prevent: Enable multi-factor sign in and restrict access to customer records by role.
  • Recover: Test restoring the claims system from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Information security manager Target: Within 30 days Early warning: Repeated failed sign in attempts or a claim payment made after a contact detail was changed.
H08

Regulatory reporting, tax and governance failures

Legal and compliance Before 12 After 6

Returns, solvency reporting or tax filings are late or misapplied, and the board does not receive the information it needs to oversee underwriting and reserving decisions.

Who or what is affected: Board, management and regulators

Causes

Rules that differ by jurisdiction and change over time, and small teams filing at the last minute.

Consequences

Penalties, restated figures and loss of regulator trust.

Existing controls

  • A compliance calendar lists the main returns and deadlines.
  • A board committee reviews the regulatory position each quarter.

Control gaps

Jurisdiction is assumed, and current rules are not confirmed before each filing.

Additional controls

  • Prevent: Give every filing a named owner and a backup, checked monthly.
  • Detect: Have a qualified reviewer test a sample of returns against the rules that apply.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Head of compliance Target: Within 30 days Early warning: A filing due within 10 days with no preparer or reviewer named.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls, and it must never be higher than the inherent score. Impact is judged on money lost, capital effect, time to correct, customer harm and damage to trust. A reserving or pricing risk is never rated down only because its loss has not yet emerged. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Critical risks would go straight to the board. Ratings are challenged by people who do the work, by the actuarial and compliance functions, and by a periodic independent review, and they are revisited whenever a warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Loss ratio by underwriting segment compared with its approved band each quarter.Escalate to the head of underwriting when a segment is outside its band for one quarter, and to the board when it stays outside for two.
Claims settled above reserve estimate without a recorded reason.Escalate to the claims director when the share rises above the agreed tolerance, and review the sample within two weeks.
Reinsurance recoverable balances overdue beyond the agreed period.Escalate to the reinsurance manager at once, and to the chief financial officer if the balance is still open after 30 days.
Payment changes made without a call back to a known contact.Escalate to the special investigations manager at once, and hold the payment until it is confirmed.
Filings due within 10 days with no named preparer or reviewer.Escalate to the head of compliance at once, and to the chief executive if still open after three days.

Contingency arrangements

If a serious event occurs, such as a major catastrophe loss, a confirmed fraud ring or a reinsurer that cannot pay, the claims director stops affected settlements pending review, preserves files and informs the chief executive and the board. The information security manager isolates affected systems and restores data from the latest tested backup. The reinsurance manager contacts the panel and the broker to protect recoveries. Regulators and legal advisers are contacted through the head of compliance as required in the relevant jurisdiction, and customers are told plainly what they need to know and what to do next.

Prioritized action plan

  1. Introduce a documented rating basis and peer review for any risk priced outside guideline bands, owner head of underwriting, within 60 days.
  2. Adopt a standard claims evaluation checklist and monthly file sampling, owner claims director, within 45 days.
  3. Confirm every change of payee or bank detail by call back, owner special investigations manager, within 45 days.
  4. Enable multi-factor sign in and test a restore of the claims system from backup, owner information security manager, within 30 days.
  5. Set up a compliance calendar with a backup owner for each filing, owner head of compliance, within 30 days.

Conclusion

Sound insurance depends on a few steady habits: documented rating, consistent claims evaluation, reserves tested against outcomes, spread reinsurance with watched counterparties, call back checks on payments and a calendar for every filing. The highest inherent scores sit with pricing, reserving and cyber exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified actuarial, legal, tax and regulatory advice for any real underwriting or reserving decision.

Assumptions and limitations

Assumptions

  • The carrier is authorised to write general insurance and reports under one recognised accounting and solvency framework.
  • Underwriting, claims and reinsurance staff use managed systems with individual sign in.
  • Jurisdiction and product wording are not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real insurer, portfolio or reinsurance programme.
  • Insurance, reserving, solvency and tax rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not actuarial, underwriting, legal or financial advice.

Related frameworks to study

  • Enterprise risk management framework with risk appetite statements
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Internal control framework with control activities and monitoring

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Insurance Underwriting, Claims and Reinsurance course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners