Plugging gaping holes in protection

More and more companies are turning to captives to manage risks that are not well-served by traditional insurance products. These vehicles have increased in popularity, especially in healthcare, financial services, retail, and manufacturing industries. Another key area is cyber, where high costs and limited coverage has driven many companies to seek alternative solutions.

In fact, Marsh says that the number of its clients with captive solutions writing cyber insurance has more than doubled in the past five years. The insurer adds that some firms are using captive solutions for retention purposes when buying larger limits, while others are using them to offset a significant rate increase or fill in missing capacity.

Julia Graham, chief executive officer at Airmic adds: “Captives have long been used by businesses to insure risks that they are struggling to attain cover for in the commercial market and at Airmic we have heard increasingly from our members in the last two years that they are more likely to use their captive to insure cyber. A well-capitalised captive can fill gaps in policies, buy back exclusions from the commercial market or provide additional capacity.”

Enter MIRIS

Recently, several European organisations including Airbus, BASF and Michelin announced that they are joining forces to create a new cyber insurer. MIRIS will be a mutual, owned and operated by its members. It will be based in Brussels and will provide €25m of capacity, rising to €30m by its third year of operations. This additional capacity should help to address the gaps left by a hardening insurance market.

This is not the first time that a mutual has been created to plug holes in insurance provision. Indeed, many large insurance companies today were founded by their customers. These include FM Global, HDI, ACE (today Chubb) or XL (today AXA XL).

There is also a long history of establishing mutuals for specific fields or industries when traditional insurance markets failed to meet the demands of the customers. For instance, previous successful ventures include OIL (now called Everen) for the global energy industry, or EMANI, ELINI and NEIL for the nuclear industry in Europe, or AEGIS and EIM for excess liability in the US.

Dr Patrick Fiedler, board member at GNVW says: “The industry historically has always considered to help itself rather than solely relying on insurance companies… The creation of MIRIS as a mutual for cyber risks founded by European multinational companies this year, can be seen in the light of this tradition.

“Having said that, the nature of MIRIS is not to compete with traditional cyber markets, but to provide specific benefits to its members.”

A step forward for insurance cover

For some commentators, the creation of captives represents a leap forward in the way that cyber risks are managed. One benefit is that insureds having ownership of the claims activity and loss history can enhance understanding of risk and allow the captives to provide policies and cover that are fit-for-purpose.

With a mutual solution such as MIRIS, additional advantages include extremely low expense ratios and the possibility that members can choose to insure only the best risks. There is also an opportunity to reduce some biases and simplify underwriting.

Thomas Keist, Global Captive Solutions leader at Swiss Re Corporate Solutions says: “In my view, this is a significant step in the development of the market for cyber risk insurance. With the challenges that commercial insurers face in offering sufficient capacity vis-à-vis the demand, it is now the industry itself which showcases confidence in its own capabilities to keep the risk under control and to finance it within a diversified portfolio of companies.

“Captives are an ideal way to retain and manage difficult to insure risk, since they ensure the active management of risk mitigation as well as the consistent collection and analysis of risk- and loss-related data. And who is better suited to gain access to all the relevant information if not the captive? This helps to make difficult to ensure risk more insurable, also for the future.”

Insurance market failures

Despite the benefits of captive solutions, many experts argue that the creation of mega-captives such as MIRIS highlight a failure of the insurance markets in meeting customer needs.

The Mercer Marsh Benefits People Risk report 2022, identified cybersecurity and data privacy as the top risk for the second year running. The global survey of 2,594 organisations including 1,280 Risk managers and 1,314 HR professionals across 25 countries said that cyber threats are both the most likely to happen and to have the most severe consequences.

This raises questions about the role of insurance companies when firms are forced to self-insure the risks that matter most of them.

Graham says: “When corporates go down the route of forming mutuals or group captive to provide new capacity and cover to themselves and peers, it highlights that the commercial market is not providing adequate solutions and/or capacity… MIRIS is an example of a response to corporate frustrations in the area of cyber insurance.”

Adrian Clements, chief risk officer at AT-IPIC adds: “If a captive with little portfolio effect can finance the risks, then what are the large insurance companies doing? Why can’t these underwriters price the same risk?

“Has there been a steady change in insurance companies’ business models away from the original intent as implied by the inability to transfer those risks a company doesn’t want or needs security for?

”This ultimately raises the question, ‘Why do I need insurance if they are not willing to share the risk?’.”

A risky business

When run well, captives and mutuals can plug capacity gaps at affordable rates, however there are several risks that organisations must consider before they embark on forming such vehicles. One key consideration is the possibility of several large claims in the early days of the project. Risk managers should think about using reinsurance market to support these ventures by providing catastrophic stop loss cover.

Fiedler says: “Especially in the first years, the risk of claims that may lead to additional capital requirements is important. This can be mitigated e.g. with re-insurance. Once up and running, there may be a risk of underestimating the regulatory complexity especially in jurisdictions with lesser captive experience such as Germany. In case of mutuals or other multi-parent captives, a key risk is to determine the set of parameters in order to allow only members with the right risk profile and risk management maturity. “

Organisations considering self-insurance solutions need to have a thorough understand of the threat landscape as well as their own risk profile and maturity. 

Graham adds: “If risk managers are going to insure more lines of insurance through their captive, including cyber, then they need to make sure they fully understand the risk and model potential losses.

“It’s also vital that whatever the captive is asked to carry, the cover, scope and limits proposed are aligned to the risk culture and risk appetite of the company and its parent - and that the directors of the captive are comfortable in being able to deliver their governance responsibilities.”

Risk managers should not underestimate the resources and efforts needed to run a captive and its risk management-related activities. These are even more complex for a mutual solution as risks are shared and your organisation may need to finance the claims of other members.

Keist explains: “A multi-parent set-up like a mutual obviously adds a certain complexity to the equation but at the same time offers the great opportunity to gather and analyse data consistently over a representative portfolio of different risk profiles.”

No silver bullet

Regular strategic and operational reviews can help to ensure that the initial objectives of the captive are being met and that subsequent opportunities are not missed. Good governance will also flag when changes are required and give the vehicles the agility needed to adapt to increasingly volatile markets.

It is also important to understand the limitations of these solutions. As Fiedler concludes: “Captives are generally not suitable to provide short-term solutions due to the complexity, capitalisation requirements and regulatory framework, and hence are naturally more suitable to provide long-term solutions.

“Addressing capacity constraints and rising cost are among the general reasons for running captives. However, captives are certainly no silver bullet that easily fix all shortcomings. Advantages of captives include flexibility and low expense ratios.

“On the downside, captives will usually only be able to use the standard Solvency II model rather than creating their own model, something that often is seen as an advantage of traditional carriers for optimising the use of the capital.”