Lesson 2.47: Risk financing: retain, mitigate or insure?
The CFO has three insurance quotes for ransomware and a mitigation proposal from security, and asks which combination is right. The simulation from Intro 401 can answer: for each option, how much does the company expect to pay in a normal year (premium plus the losses it still carries), and what happens in a very bad year? Cheapest on average isn't automatically best: a low limit can leave the 1-in-100 year almost uncovered. In the lab you price retention, three policies and mitigation against the same 1,000 simulated years, read the policy's exclusions and write the recommendation.
21 min
You will learn to
- Explain retain, mitigate, transfer (insure) and avoid
- Compute expected annual cost of an insurance option from simulated losses
- Compare deductibles and limits with the loss tail
- Read exclusions and notice conditions
- Recommend a combination for the CFO
Key terms
- Risk treatment options
- Retain (accept), mitigate (reduce), transfer (insure, contract) or avoid.
- Premium
- What you pay the insurer each year.
- Deductible (retention)
- The part of each loss you pay before the insurer pays.
- Limit
- The most the insurer pays; anything above it is yours again.
- Exclusion
- An event the policy doesn't cover, e.g. war or state-backed operations as defined in the policy.
← Security operating model and managed providers · All lessons · Getting help on the command line →