Insurance remains an essential part of commercial risk management, but in an increasingly complex and interconnected risk landscape, financial protection alone is no longer enough.

For decades, many organisations have viewed commercial insurance primarily as a mechanism for transferring risk. If a fire occurred, a cyber incident disrupted operations, an employee was injured or a public liability claim emerged, the policy would respond and help restore financial stability.

However, climate volatility, cyber accumulation, geopolitical tension, supply chain fragility, workforce pressures, social inflation and fast-moving technologies are creating exposures that can be difficult to predict, price or fully insure. Disruption in one part of an organisation can quickly affect operations, people, customers, suppliers and capital.

Modern risk strategy therefore requires a more integrated approach. The most resilient organisations combine risk transfer, risk management, risk retention and risk resilience to control not only the financial impact of a loss, but also its likelihood, severity and duration.

Keep reading as we explore how these four disciplines work together, what they mean for commercial insurance strategy and the practical steps organisations can take to build greater resilience.

Why insurance alone is no longer enough

The question for organisations should no longer simply be: “How much insurance can we buy?”

Instead, boards and risk leaders should be asking:

“Which risks should we prevent, transfer, retain and prepare to recover from?”

Each element of this approach has a different role:

• Risk management: How can we reduce the likelihood or severity of loss? This includes controls, engineering, training, assurance and analytics.
• Risk transfer: Which losses could threaten the organisation? Insurance, contractual transfer and reinsurance can help protect the balance sheet.
• Risk retention: Which losses can the organisation absorb efficiently? This can include deductibles, self-insurance, captives and reserves.
• Risk resilience: How can the organisation continue operating and recover when disruption occurs? Business continuity, crisis response, redundancy and recovery planning all play a role.

These are not competing approaches. They are interconnected parts of an effective commercial risk strategy.

Risk transfer: Protecting the balance sheet

Risk transfer remains one of the foundations of commercial insurance.

In its most familiar form, an organisation pays a premium to transfer defined financial consequences to an insurer. Property, liability, cyber, professional indemnity, directors’ and officers’, motor and business interruption cover can all protect capital against severe and volatile losses.

However, transfer is never complete.

Policies contain limits, exclusions, deductibles, conditions and waiting periods. Some consequences of an incident, including reputational damage, management distraction, customer loss and long-term strategic delay, may also be difficult or impossible to insure.

Contract certainty and a clear understanding of uninsured exposure are therefore just as important as premium and policy limits.

In a more selective insurance market, organisations that can demonstrate credible risk controls, good governance and effective recovery capabilities can also present a stronger risk to insurers. Better-quality risk information can improve underwriting conversations and help organisations clearly demonstrate how their risk profile differs from others in the market.

Risk management: Reducing the probability and severity of loss

While insurance deals primarily with the financial consequences of an event, risk management addresses its causes and development. The objective is to identify hazards, understand exposure and implement controls before an incident becomes a claim. Depending on the organisation, this could include:

• Ergonomic assessment
• Fire and life safety
• Cyber controls
• Driver risk management
• Security
• Occupational health
• Supplier assurance
• Workforce consultation

The commercial value extends beyond compliance.

Effective controls can reduce claim frequency and severity, improve productivity, support employee wellbeing and create better-quality underwriting data. Prevention can also give organisations more flexibility when deciding how much risk to retain through deductibles, self-insurance or captive arrangements.

At Cardinus, we believe prevention should be viewed as a measurable insurance and resilience intervention rather than simply a compliance activity. Exposure data, control verification and outcome tracking can help connect workplace improvements directly to underwriting, claims performance and total cost of risk.

Risk retention: Choosing what to keep

Risk retention occurs whenever an organisation accepts financial exposure rather than transferring it to another party.

In reality, every insurance programme already involves some level of retention through deductibles, exclusions and uninsured losses. The important question is whether that retention is accidental or deliberately designed.

Predictable, higher-frequency and lower-severity losses may be more economical for an organisation to retain, providing it has sufficient liquidity, governance and claims capability.

Catastrophic, volatile or balance-sheet-threatening exposures, by contrast, are generally more appropriate for risk transfer.

Between the two sit options such as:

• Higher-deductible programmes
• Self-insurance
• Captives
• Protected cells

A captive should not simply be viewed as a way to reduce insurance premium. It can formalise risk ownership, fund retained losses, provide cover for difficult exposures and create a direct financial incentive for better loss control.

However, captives also introduce governance, capital, reserving and regulatory responsibilities. Retention decisions should therefore be supported by actuarial analysis, stress testing, scenario modelling and a clearly defined risk appetite.

Importantly, greater risk retention also increases the need for effective risk management. If an organisation is accepting more financial exposure itself, preventing and controlling losses becomes even more valuable.

Risk resilience: Protecting the operating model

Even the strongest controls cannot prevent every incident.

Risk resilience is an organisation’s ability to anticipate disruption, withstand its immediate effects, maintain critical activities, recover effectively and adapt afterwards. If risk management reduces the likelihood of something going wrong, resilience accepts that controls will sometimes be exceeded. Measures could include:

• Duplicate systems
• Alternative suppliers
• Crisis leadership arrangements
• Emergency communications
• Cyber recovery capabilities
• Workforce cross-training
• Backup facilities
• Tested business continuity plans

These capabilities protect value that an insurance payment alone cannot restore, including customer trust, service continuity and market position.

A policy may fund repairs or indemnify a covered financial loss, but an organisation still needs the operational capability to make decisions, communicate effectively, continue priority services and recover within an acceptable timeframe.

How the four disciplines work together

Risk management, transfer, retention and resilience work most effectively as a connected system.

Better risk management reduces expected losses. Better resilience reduces interruption time and the secondary consequences of an incident. Both can improve the quality of the risk presented to insurers. Better information then enables organisations to make more precise decisions about which exposures they should transfer and which they can retain.

The consequences of getting this balance wrong can be significant:

• Poor risk management increases claim frequency and can weaken underwriting confidence.
• Poor resilience can allow an insured incident to develop into a prolonged operational crisis.
• Poor risk transfer decisions can leave catastrophic gaps or result in organisations paying to insure losses they could comfortably absorb.
• Poor risk retention decisions can create earnings volatility, liquidity pressure and unexpected demands on capital.

The practical objective should therefore be to optimise the total cost of risk, rather than simply focusing on reducing the insurance premium.That means considering expected retained losses, the cost of risk transfer, prevention investment, claims costs, volatility, downtime and the value of faster recovery together.

What does an integrated approach look like in practice?

Several large organisations provide useful illustrations of how prevention, financing and recovery can interact. These examples should not be viewed as assessments of each organisation’s complete insurance programme, but as illustrations of different aspects of an integrated risk strategy.

Microsoft: Cyber prevention and operational resilience

Microsoft’s public approach to security and cloud resilience demonstrates the importance of combining preventive controls with continuity and recovery capability. For a large technology organisation, insurance can provide financial protection, but technical resilience, distributed infrastructure, incident response and recovery processes are also essential to maintaining services. The broader lesson is that cyber insurance should support, rather than replace, a mature cyber security and resilience programme.

Maersk: Cargo risk, insurance gaps and supply chain continuity

Maersk’s 2026 risk commentary has highlighted how geopolitical conflict, rerouting, war-risk exclusions and onshore storage exposures can create gaps in conventional cargo insurance arrangements. The strategic lesson is that marine risk cannot be managed through an insurance policy alone. Route decisions, cargo visibility, contractual clarity, contingency planning and appropriate specialist cover all need to operate together.

Walmart: Scale, prevention and self-funded exposure

Large retailers illustrate why predictable losses, safety controls and operational resilience must be considered together. High transaction volumes, extensive workforces and complex supply networks can create frequent operational exposures alongside low-frequency catastrophic risks. The integrated approach is to control routine losses, retain an economically supportable layer of exposure, transfer severe volatility and maintain continuity through measures such as inventory visibility, alternative suppliers and emergency planning.

Johnson & Johnson: Quality, liability and continuity

Life sciences organisations demonstrate how product quality, regulatory compliance, liability transfer and supply continuity interact. Prevention relies on disciplined quality and safety systems. Insurance protects against defined severe events, while retention and reserves can address predictable exposures or risks that are not fully insurable. Resilience then depends on the organisation’s ability to protect critical supply, respond effectively to incidents and learn from failures.

Commercial insurers: From claim payer to resilience partner

The role of the commercial insurer is also evolving.

Insurers such as Zurich and Liberty Mutual have publicly described a risk environment that is becoming more volatile and interconnected, requiring organisations to improve how they anticipate, respond to and adapt to disruption.

Zurich, for example, has highlighted the increasing role of advanced modelling, risk engineering and closer engagement between organisations and insurers as businesses respond to greater volatility.

Risk engineering, climate modelling, cyber response support and business continuity advice can complement policy capacity. The insurer benefits from improved risk quality, while the client can receive value before, during and after a loss.

Eight steps towards a more integrated risk strategy

Bringing risk management, transfer, retention and resilience together requires a structured approach. Organisations should consider the following:

1. Define risk appetite: Establish the level of volatility and loss the organisation is willing and financially able to absorb.
2. Map critical exposures: Identify the assets, people, processes, suppliers, technologies and dependencies that could affect strategic objectives.
3. Quantify loss scenarios: Model frequency, severity, aggregation, downtime and cash-flow impact, including credible worst-case scenarios.
4. Evaluate controls: Test whether preventive and mitigative controls are implemented, current and demonstrably effective.
5. Test resilience: Exercise crisis management and business continuity arrangements against realistic scenarios, including situations where multiple events occur simultaneously.
6. Design retention: Select deductibles, self-insured layers or captive participation that align with available capital and cash flow.
7. Transfer catastrophe: Use insurance and contractual risk transfer for volatility that exceeds the organisation’s risk appetite or could threaten strategic objectives.
8. Measure outcomes: Track incidents, exposure reduction, claims performance, downtime, recovery performance and total cost of risk.

What does this mean for boards, risk managers, brokers and insurers?

An integrated approach has implications across the commercial insurance ecosystem.

For boards

Insurance should be treated as one part of wider enterprise resilience. Boards should challenge whether retained exposures, policy gaps and recovery dependencies are properly understood and whether realistic stress scenarios are reflected in capital and continuity planning.

For risk managers

Risk managers should connect risk registers, control assurance, claims data and continuity testing. Operational risk information also needs to be translated into financial terms so it can inform decisions around insurance and risk retention.

For brokers

The client conversation should extend beyond the annual insurance placement. Brokers can help organisations quantify risk, identify gaps, structure retention and provide insurers with evidence demonstrating the maturity and effectiveness of risk controls.

For insurers

Risk engineering and prevention services can support risk selection, pricing and wider client value.

Creating a clear connection between exposure, intervention and claims outcomes can help demonstrate the commercial value of proactive risk management.

The resilience dividend

Investment in prevention and resilience can generate benefits that extend well beyond insurance savings.

Fewer incidents, reduced disruption, better workforce outcomes, faster recovery and greater customer confidence can all contribute to improved operational performance.

The benefit is therefore not simply a lower insurance premium. It is a more dependable business. This is particularly important when considering people-related risks.

Musculoskeletal disorders, occupational health issues, psychosocial pressures, workplace violence and road risk can contribute to insurance claims, employee absence, productivity loss and reputational consequences.

Integrated prevention can therefore provide an important connection between protecting employees, improving risk quality and strengthening financial performance.

Looking ahead

In an increasingly volatile and interconnected market, insurance remains vital, but it cannot operate in isolation.

Organisations need to understand which risks they can prevent, which they can absorb, which they need to transfer and how they will continue operating when disruption occurs.

Bringing risk management, risk transfer, deliberate risk retention and tested resilience together can support better insurance decisions, stronger operational performance and a more sustainable total cost of risk.

Resilience is not a substitute for insurance, and insurance is not a substitute for resilience. The greatest value comes from designing them together.

How Cardinus can help

Cardinus helps organisations identify, manage and reduce the risks that can influence claims, premiums and underwriting decisions. Through risk assessment, control verification and data-driven insight, we can help strengthen your risk profile and provide clearer evidence of how risk is being managed. To find out how Cardinus can help strengthen your insurance risk strategy, contact us at [email protected].

Sources and further reading:

• Zurich Commercial Insurance, From volatility to resilience: how a new era of risk is transforming underwriting.
• Liberty Mutual / Risk & Insurance, Principles of Corporate Resilience.
• Aon’s Risk Retention resources
• PwC’s Captive Insurance guidance
• Marsh’s Captive Insurance insights
• Maersk article
• Maersk article

Company examples are included as strategic illustrations based on publicly available information. They are not intended to describe every element of the organizations’ insurance arrangements or evaluate their performance.