Size the limit from the loss distribution, not the premium quote, and check the sublimit on the one scenario that carries half the expected loss.
Enough to cover the loss you would expect once in fifty years, with every sublimit checked against the scenario that produces it. On four illustrative scenarios, a manager's 1-in-50 year cyber loss is $2.5m, and it is a diverted wire. A $2.5m policy with a $0.25m social engineering sublimit still leaves $2.25m retained in that year; raising the sublimit cuts it to the $0.1m retention for $0.125m of extra premium, while doubling the limit to $5m adds almost nothing.
Worked in full in Operational Due Diligence in Private Equity by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
Operational due diligence questionnaires ask whether the manager carries cyber insurance and for how much. The answer, a single limit, says little. What matters is whether the policy pays in the scenarios that actually hurt a private markets firm, and for a firm that moves capital calls and distributions by wire, the most likely large loss is not a hacker encrypting servers. It is an employee paying a convincing fake instruction. Many policies cover that only under a social engineering sublimit, a fraction of the headline limit.
| Scenario | Annual probability | Loss if it happens | Expected loss |
|---|---|---|---|
| Wire diverted by business email compromise | 4% | 2.5 | 0.100 |
| Ransomware: restoration and interruption | 3% | 1.8 | 0.054 |
| Investor data breach | 3% | 1.2 | 0.036 |
| Breach at a service provider | 2% | 0.8 | 0.016 |
| Total | 0.206 |
The scenarios are treated as independent, and each policy has a $0.1m retention per claim. The expected annual loss of $0.206m is the annualised loss expectancy of the ALE calculation; insurance needs the next step, the shape of the distribution around it.
Four scenarios that either happen or do not give sixteen possible years. The probability of each is the product of the four probabilities (or their complements), and its loss is the sum of the scenarios that occur.
P(year) = Π pixi × (1 − pi)1 − xi, with xi = 1 if scenario i occurs
Exceedance P(loss > L) = sum of P(year) over the years whose loss exceeds L
| Annual loss above ($m) | Probability |
|---|---|
| 0.0 | 11.48% |
| 1.0 | 9.67% |
| 2.0 | 4.14% |
| 2.5 | 0.45% |
| 3.0 | 0.31% |
| 4.0 | 0.12% |
The 1-in-20 year loss is $1.8m, the ransomware event. The 1-in-50 and 1-in-100 year losses are both $2.5m, the diverted wire. A loss above $2.5m needs two events in the same year, which happens 0.51 per cent of the time, and above $2.5m the exceedance falls to about once in 220 years. The worst year, all four at once, is $6.3m and almost impossible.
For each year, the recovery is the sum over events of the loss less the retention, capped by the social engineering sublimit for the wire, and the total capped by the aggregate limit. What the manager keeps is the loss less the recovery.
| Limit, social engineering sublimit | Premium | Expected recovery | Retained, 1-in-20 | Retained, 1-in-50 | Retained, 1-in-100 |
|---|---|---|---|---|---|
| 1m, 0.25m | 0.125 | 0.082 | 0.80 | 2.25 | 2.25 |
| 2.5m, 0.25m | 0.165 | 0.108 | 0.10 | 2.25 | 2.25 |
| 5m, 0.25m | 0.175 | 0.108 | 0.10 | 2.25 | 2.25 |
| 2.5m, 2.5m | 0.290 | 0.190 | 0.10 | 0.10 | 0.10 |
| 5m, 2.5m | 0.300 | 0.194 | 0.10 | 0.10 | 0.10 |
Premiums are illustrative and set at 1.53 to 1.62 times the expected recovery, so every policy costs more than it is expected to pay. That is normal: insurance is bought for the tail, not the average.
The wire scenario is 48.5 per cent of the expected loss and all of the 1-in-50 loss. The cheapest cover for it is not a sublimit but a tested callback control, priced in what an untested callback control costs. Insurance pays for the residual.
The rating model for the review in which a finding like this is recorded is in the free workbook for this book.
A lower cap inside the policy for losses where an employee is tricked into sending money, such as a wire diverted by a fake email. On a $2.5m policy with a $0.25m sublimit, a $2.5m diverted wire recovers only $0.25m and the manager retains $2.25m. For a fund manager that moves capital calls and distributions by wire, it is usually the clause that matters most.
Enumerate the loss scenarios with their annual probabilities, build the distribution of the annual loss, and buy enough to cover a chosen return period. In this case the 1-in-20 year loss is $1.8m and the 1-in-50 is $2.5m; a loss above $2.5m happens about once in 220 years, so a $5m limit buys very little.
Usually not in expected terms: here every policy costs more than it is expected to pay, with premiums 1.53 to 1.62 times the expected recovery. Its value is in the tail. The $2.5m policy with a matching sublimit costs $0.100m a year more than it is expected to pay back and cuts the 1-in-50 retained loss from $2.25m to $0.1m.
This article is one calculation from Operational Due Diligence in Private Equity. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: private equity and private markets → · All 1340 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.