Declining, or when a cyber risk is not underwritten

An underwriter spends most of its time pricing and a small part declining, and it is that small part that defines its signature. Declining is not the failure of pricing, it is a distinct decision, taken for different reasons, and it presupposes being able to say what no price compensates. The commonest confusion treats declinature as the end of a price scale: one quotes higher and higher until the client leaves. That practice has a name in the trade, it is called the deterrent quote, and it is bad for three reasons that must be named.

The first is that a deterrent quote can be accepted. A broker that needs to place a file will place it, a client without an alternative will sign, and the insurer ends up with a risk it did not want, at a price that looks comfortable and is not if the risk is genuinely uninsurable. The second is that it destroys information: the broker learns a figure instead of learning a reason, it will come back with the same file next year, and the market has corrected nothing. The third is that it damages the relationship, because a professional broker always recognizes a deterrent quote and understands that it was not spoken to frankly.

Three families of reasons must therefore be distinguished, and they do not call for the same response. What gets priced: a known, measurable risk whose frequency or severity is high but bounded. What gets conditioned: an identified and correctable defect, justifying a condition precedent, a sub-limit, or cover starting on a date by which the correction will be made. What gets declined: a risk whose extent cannot be stated, or whose extent exceeds the capacity one can devote to it. An underwriter that files every submission into one of those three families never quotes to deter.

In cyber, four configurations recur in the third family and deserve to be known in themselves. The first is the absence of a restorable backup, not declared absent but never tested: it makes the extent of the loss impossible to bound, since nobody knows whether the company comes back in three days or does not come back. The second is an information system with no inventory, which makes any declaration unverifiable and any condition inapplicable. The third is a dependency on a third party the insurer already carries massively in its book, which is not a judgment on the risk but on its aggregation. The fourth is a company already compromised without knowing it, a hypothesis a recent audit reduces and does not eliminate.

The difference between the first two and the last two deserves stating, because it changes who is being addressed. The first two are defects of the insured, and they are told to the client as conditions to be met: we decline today and we underwrite in six months if such a thing is done. The last two are not defects of the insured, they are facts about the insurer's book or about the state of the world, and the client can do nothing about them. Confusing the two produces the worst possible message, the one that lets a company believe it is badly run when it simply has the same host as three hundred other insureds.

How a declinature is delivered is therefore part of the work, and not a courtesy. A useful declinature names the reason, says whether it is correctable, and gives the condition that would reopen the file: an offline backup tested with a record of the test, an inventory of remote access, or nothing, when the reason is a portfolio aggregation. That last piece of frankness costs less than one thinks: a broker told the line is closed on that dependency will go elsewhere without resentment, whereas a broker quoted three times the market price will tell the story for two years.

Finally, one must know that a declinature is a decision that gets reread, and that systematically declining a class of risks becomes a policy nobody deliberated. An underwriter declining every company in a sector, or every one below a size, has taken a portfolio decision without presenting it as such. The discipline consists in counting declinatures by reason, rereading them each quarter, and distinguishing those coming from the file from those coming from an implicit instruction. It is the only way of knowing whether one is underwriting a market or withdrawing from it without having said so.