Between a water depth and an invoice, there is a curve. It takes an intensity as input, a depth in centimeters above floor level, a gust speed, a ground acceleration, and it returns a damage ratio: the fraction of the asset's value that is lost. It is called a vulnerability function or a damage curve, and it is the piece of the model that translates physics into money. Everything else, hazard and exposure, only feeds it.
The first thing to know about it is that it returns an AVERAGE, and that this average poorly describes the reality it summarizes. Under forty centimeters of water, a curve may report a damage ratio of twelve percent. That does not mean each building loses twelve percent of its value. It means that across a large number of buildings of that class, some will have lost two percent and others forty, and that the average falls there. On a portfolio of ten thousand risks, the average is the right information. On a single site, it says almost nothing, and that is the most frequent use made of it.
Models know this and therefore attach to each point a second piece of information, the spread around that average, called secondary uncertainty. It is what allows the model to return a distribution rather than a number. It is also what most readers ignore, because the outputs circulated inside a company are averages, and an average fits in a table whereas a distribution needs a page. A file in which only the average circulates loses exactly the information that would have allowed a retention to be sized.
The second thing to know concerns how these curves are built, and it governs their zone of validity. They are fitted on observed losses, supplemented by testing and engineering judgment. But observed losses are censored at the bottom: below the deductible nobody notifies, so nobody measures. The lower part of the curve, that of low intensities, therefore rests on little real data, sometimes on none. That is precisely the part used most, since small events are the most frequent.
The third concerns the fact that the curve knows only what it was told. A vulnerability function for a warehouse assumes an ordinary warehouse. If the asset described as a warehouse actually holds high-value stock per square meter set down on the floor with no racking, the curve will return a damage ratio calibrated for pallets, applied to a value that is not one. The error does not come from the model, it comes from an occupancy field filled in carelessly, and it is invisible in the output: the number comes out, formatted, plausible, and wrong.
One must finally distinguish what the curve covers from what it leaves out, because that split explains many gaps between a modeled loss and an actual burden. A standard vulnerability function returns direct damage to the asset. It returns neither business interruption, nor adjusting costs, nor the post-event inflation that makes reinstatement work cost more when three thousand buildings demand it in the same week. Those terms are laid on top, with their own assumptions, and they are often the ones that decide the overrun.
The conduct to adopt therefore comes down to three questions to ask before using an output. On which asset class was this curve calibrated, and does my asset genuinely belong to it. Is this an average alone, or is the spread available. And what is not in it, that will have to be added elsewhere. None of these questions requires knowing how to build a model; all of them require refusing to read a damage ratio as if it were a measurement of the building in front of you.
A broker prepares the renewal of an industrial site in a flood zone, insured value 46 million euros for property. For the reference event retained, the model returns a water depth of 45 centimeters above floor level and an average damage ratio of 11%, that is a modeled loss of 5.1 million. The finance director wants to set his retention on that figure. Two items appear in the technical file and have not been discussed: the plant's output rests on three machining centers whose control cabinets sit on the floor, and the electrical intake station is in the basement. What must be said before the retention is fixed?
The 5.1 million figure is a class average applied to a single site, and that is the one use it is not made for. Across ten thousand comparable buildings, eleven percent would be the right information; on this one, the question is which side of the average it falls on, and the two undiscussed items answer it. A depth of 45 centimeters is below almost all the structure and above almost all the control electronics: floor-mounted cabinets and a basement intake station place this site in the upper part of the spread, where the damage ratio on the asset says nothing any more, because the loss turns on equipment whose replacement cost is small and whose replacement lead time is long. The first step is therefore to ask the model vendor not for the average but for the spread around it, failing which there is nothing to size. The second is to check the declared occupancy class: a machining site entered as a warehouse receives a curve calibrated for pallets, which flattens exactly the sensitivity being sought. The third is to take out of the curve's scope what is not in it: business interruption is not inside those 11%, and on a stoppage driven by the lead time for control cabinets, it will dominate the property burden. Setting a retention on a class average, with no spread and no interruption term, would be neither a prudent nor an imprudent decision: it would be a decision taken on a quantity that does not answer the question asked.
- 01A damage curve returns a class average: right across ten thousand risks, almost silent on a single site.
- 02The spread around the average, secondary uncertainty, is what allows a retention to be sized; it is also what disappears from the tables that circulate.
- 03The lower part of the curves is calibrated on losses censored by deductibles, therefore on little real data, and that is the part used most.
- 04A misdeclared occupancy class produces a formatted, plausible and wrong number, with nothing in the output flagging it.
- 05A standard vulnerability function returns direct damage to the asset: neither business interruption nor post-event inflation, which are laid on top.