What the underwriter asks for in the file, before deciding

The five previous lessons read clauses and claims. This one stands before them: at the moment the underwriter receives a file and must know whether it can be understood well enough to decide. It says neither which clause to choose, nor which limit, deductible or premium to set: those decisions belong to each underwriter, according to appetite and portfolio, and the observatory recommends none. It says which information makes those decisions possible, and why each item follows from a provision of the clauses studied. A file where it is missing is not a bad risk; it is a risk that cannot be read yet, and the underwriter's first decision is then to say so.

First group of questions: the text. Which clause of the LMA 5564 to 5567 family does the policy carry, or which in-house clause, and in which version, A or B? If it is a 5565, what amounts appear in paragraphs 2.1 and 2.2, since a field left in curly brackets makes it a 5564? Do the other policies in the program, property, liability, crime, carry an inherited war exclusion or a cyber affirmation, and which applies when two policies respond to the same event? The cyber underwriter who does not know what the insured's property policy says does not know what it covers alone. Finally, which law governs the contract and which court will decide: the Merck case showed that a sentence is read according to the rules of construction of the judge reading it.

Second group: the geography of systems. The 5567 write-back and the attribution clause both depend on the physical location of systems. The file must therefore say in which countries the insured's data centers sit, the regions of its cloud providers, the backup sites its continuity plans fail over to, and the systems of its critical providers: managed services, payroll, payments, enterprise software. An answer such as "in Europe" is not enough, since the impacted state is established country by country. The case in the previous lesson showed it: a backup site rented in another country can move part of the loss into the exclusion on the very day it does its job. The map requested is the map of machines, not of subsidiaries.

Third group: dependence on the essential services of the countries where the insured operates. Paragraph 1.3 does not look at the insured's loss, it looks at the condition of the country. A lightly attacked insured can see its loss excluded because the power grid or the payment system of its host country went down under a state operation. The underwriter therefore asks in which countries the business depends on a local essential service, electricity, payments, telecommunications, health, and whether there is a fallback outside those countries. This is a political risk question in the proper sense: it concerns a country's exposure to a state operation, and it is read with the same sources as a political violence file, tensions between states, precedents of attacks on infrastructure, past attributions.

Fourth group: the insured's profile with regard to state operations. Some sectors are natural targets: defense suppliers, energy, government bodies and their providers, telecommunications operators, software vendors whose product is installed at thousands of clients, as was the accounting package through which NotPetya got in. The file says whether the insured belongs to one of these sectors, whether it has already suffered an incident whose presumed author was a state service, and what its incident response provider concluded. The underwriter keeps in mind the limit of this information: a state service can act under the banner of a criminal group, a criminal group can pass itself off as a state service, and a public attribution can come months later, or never.

What to do with the answers? Write them down, with their date, in the underwriting note, and write next to them the decision taken and its reasons. The decision itself is not the subject of this lesson; its form is. A note that says "the policy carries 5567A; the servers are in France and Germany; the enterprise software is hosted by a provider in a neighboring country whose power grid is a service the business depends on; here is the position taken and why" can be reread after a loss and compared with what happened. A note that says "standard war exclusion" cannot, because it states neither which text, nor which geography, nor which reason. That is the difference between explaining a risk and underwriting it: underwriting leaves a dated record that can be judged later.

The course ends here, on the path it has followed: where the clauses come from, what each excludes and keeps, the geography of the impacted state and of attribution, what the judges read, a claim worked in order, and the file that allows one to underwrite knowing what one signs. Sources: the text of clauses LMA 5564A to 5567B of January 18, 2023, published by the Lloyd's Market Association and reproduced in the observatory's comparator; Lloyd's Bulletin Y5381, August 16, 2022, requirement on systems located outside impacted states, cross-checked against Kennedys and Clifford Chance; the Merck and Mondelez cases, see the fourth lesson. The examples in this lesson are invented.