Insurance risk management: the top risks 97 insurance companies disclose
Good insurance risk management starts with knowing which risks your peers actually face. Insurers manage risk for a living, so their own risk disclosures are unusually detailed. We counted how many of 97 US-listed insurers, brokers and insurance service firms disclose each risk in their latest annual report, and compared the result with fourteen other industries. Here is what the insurance industry says about its own risks — and how to turn that into a working register.
Nearly every insurer in our sample (98%) discloses the risk of a cyberattack — a higher share than any other industry except retail. The risks that are distinctive to insurance concern the holding-company structure, the investment portfolio, regulation, reinsurance, reserves, catastrophes and distribution.
- Cyberattack exposing data and disrupting operations: 98% of insurers (84% on average in the other fourteen industries).
- Intense competition: 91%.
- Restricted dividends from subsidiaries to the holding company (76% vs 20%) and investment portfolio value losses (76% vs 9%).
- Extensive and changing insurance regulation: 75% (1% elsewhere). Dependence on agents and brokers: 54% (0% elsewhere).
- Insurer or reinsurer failure to pay (67%), inadequate loss reserves (64%) and unavailable or costly reinsurance (59%).
Turn this list into your own risk registerRisk Samurai starts you with the risks typical for insurance companies, then helps you score them, assign owners and track actions.
Get early accessHow we built this. We took the Risk Factors section of the latest annual report of 97 US-listed insurance companies on SEC EDGAR (filed 10 March 2025 to 25 August 2026), recorded every disclosed risk and grouped equivalent risks across companies. “Share” is the percentage of insurance companies whose filing discloses the risk. Disclosure is not likelihood: filings are written by lawyers, are over-inclusive and come from public companies that are mostly larger than a typical small business, and shares are approximate. Full method and caveats.
Who is in the sample
The benchmark covers 97 insurance companies: all 97 filed a Form 10-K, with filing dates between 10 March 2025 and 25 August 2026. By SEC industry code (SIC), the group is made up of 50 fire, marine and casualty insurers (6331), 20 insurance agents, brokers and service firms (6411), 12 life insurers (6311), 7 surety insurers (6351), 5 accident and health insurers (6321) and 3 title insurers (6361).
In plain words, this is a sample of mostly mid-sized and large carriers and brokers. Median annual revenue is about $1.7 billion and the largest company reports about $371.4 billion; at the bottom, the smallest shows zero revenue in our data. The median filing yields 54 distinct risks (range 25–108). Half of the companies are property and casualty insurers and a fifth are brokers and service firms, so risks such as loss reserves and catastrophe claims apply mainly to carriers, while distribution and competition risks apply to both.
| Measure | Value |
|---|---|
| Companies | 97 |
| Annual reports | 97 × 10-K |
| Filing dates | 10 March 2025 – 25 August 2026 |
| Annual revenue | median $1.7 billion; smallest $0; largest $371.4 billion |
| Risks identified per filing | median 54 (range 25–108) |
| Company-level risks the filing explicitly calls new this year | 3.7% |
The top 30 risks insurance companies disclose
The table ranks risks by the share of insurance companies whose annual report discloses them. The last column is the average share across the other fourteen industries in our study, so you can see at a glance whether a risk is generic to listed companies or particular to this sector. Risks marked distinctive are disclosed by at least 20% of insurance companies and by at least 15 percentage points more than in any other industry.
| # | Risk | Insurance companies | Other industries (avg) |
|---|---|---|---|
| 1 | Cyberattack exposing data and disrupting operations Hacking, malware or ransomware against company systems exposes confidential or personal data and disrupts operations, causing liability, regulatory penalties, financial loss and reputational damage. | 98% | 84% |
| 2 | Intense competition eroding share and pricing Larger, lower-cost, private-label or new competitors undercut prices or outperform on products, causing loss of customers, market share and margins. | 91% | 69% |
| 3 | Dependence on restricted subsidiary distributions distinctive Legal, regulatory or contractual limits on subsidiary dividends leave the holding company without cash to service debt, pay taxes, expenses or shareholder dividends. | 76% | 20% |
| 4 | Investment portfolio value losses distinctive Adverse interest rate, credit or market movements reduce the value and liquidity of investment portfolios, causing impairments, realised losses and lower income. | 76% | 9% |
| 5 | Extensive and changing insurance regulation distinctive Extensive and changing insurance regulation may restrict pricing, products and growth, raise compliance costs and bring fines or licence revocation. | 75% | 1% |
| 6 | Economic downturn reducing customer demand Recession, inflation, tariffs or geopolitical shocks lead customers to cut or delay spending, reducing demand, volumes, prices and revenue. | 69% | 30% |
| 7 | Insurer or reinsurer failure to pay distinctive Insolvency or refusal of insurers or reinsurers to pay leaves covered losses unrecovered and the company liable for claims it expected to cede. | 67% | 1% |
| 8 | Inadequate insurance loss reserves distinctive Uncertain claims estimates, inflation and adverse development may leave insurance loss reserves inadequate, forcing strengthening charges that reduce earnings, capital and ratings. | 64% | 0% |
| 9 | Reinsurance unavailable, inadequate or costly distinctive Hard markets, catastrophes or reinsurer rate rises make reinsurance unavailable or costly, forcing higher retention or reduced underwriting and lowering profitability. | 59% | 0% |
| 10 | Catastrophe claims exceeding reserves and reinsurance distinctive Natural, man-made or terrorist catastrophes generate claims above pricing, reserves or reinsurance limits, causing volatile earnings and strain on capital. | 58% | 0% |
| 11 | Adverse litigation and legal proceedings Lawsuits, claims and legal proceedings may produce adverse judgments, settlements and defence costs exceeding insurance, diverting management and harming reputation. | 57% | 64% |
| 12 | Acquisitions fail to integrate or deliver benefits Poor selection, valuation or integration of acquired businesses diverts management and disrupts operations, so expected synergies and returns are not realised and results suffer. | 55% | 75% |
| 13 | Dependence on insurance agents and brokers distinctive Concentration of premium through independent agents and brokers who may divert, consolidate or reprice business could reduce sales, retention and revenue. | 54% | 0% |
| 14 | Inability to raise additional capital Adverse market or company conditions prevent raising debt or equity on acceptable terms, forcing curtailed growth or operations, or dilutive and restrictive financing. | 49% | 48% |
| 15 | Evolving AI laws and liability New, divergent AI laws and flawed AI outputs may restrict AI use, require costly compliance changes and expose the company to fines and liability. | 48% | 41% |
| 16 | Investment portfolio issuer default distinctive Default or downgrade of issuers of fixed-income and other portfolio securities impairs portfolio value, reduces investment income and causes realised losses. | 48% | 1% |
| 17 | Adverse changes in tax laws and rates Changes in domestic or foreign tax laws, rates or interpretations increase effective tax rates and cash taxes, reducing earnings and cash flow. | 47% | 53% |
| 18 | Internal IT system failure or outage Failure, defect or interruption of internal information systems could halt transaction processing and services, causing financial loss, data loss and reputational harm. | 47% | 44% |
| 19 | Flawed quantitative models and data distinctive Flawed, misused or poorly specified pricing, valuation, reserving or catastrophe models and data produce inaccurate estimates, causing mispricing, unexpected losses and misstated results. | 46% | 3% |
| 20 | Third-party vendor breach exposing company data Weak security at vendors or service providers holding company, customer or employee data leads to a breach, causing data exposure, regulatory liability, litigation and reputational harm. | 45% | 31% |
| 21 | Insurance market cycles and capacity shifts distinctive Soft market cycles, catastrophes and changes in insurer or reinsurance capacity depress premium rates and volumes and disrupt placement of cover. | 44% | 0% |
| 22 | Failure to keep pace with technological change Rapid technological change outpacing investment and adoption leaves products, platforms and systems obsolete or uncompetitive, causing lost customers, market share and profitability. | 43% | 33% |
| 23 | Credit rating downgrade distinctive Deteriorating financial strength leads to a credit or financial strength rating downgrade, raising borrowing and collateral costs and restricting access to funding. | 42% | 7% |
| 24 | Outsourced service provider failure Underperformance or failure of outsourced providers of critical business functions, with weak oversight, may disrupt operations, raise costs and be hard to replace. | 42% | 18% |
| 25 | Insurer capital and solvency requirements distinctive Failure to meet or rises in risk-based capital and solvency requirements may trigger regulatory intervention, dividend limits and rating downgrades. | 41% | 0% |
| 26 | Loss of senior executives or key employees Unexpected departure of senior executives or key employees without ready replacements could disrupt operations, impair strategy execution and harm financial results. | 41% | 56% |
| 27 | Financial strength rating downgrade distinctive A downgrade or loss of financial strength ratings reduces distributor and customer confidence, causing lost business and higher funding and reinsurance costs. | 41% | 0% |
| 28 | Evolving privacy laws raising compliance costs New, changing and inconsistent privacy laws across jurisdictions require costly changes to systems and practices, raising compliance costs and exposure to penalties. | 39% | 42% |
| 29 | Legal developments expanding insurance coverage distinctive Court rulings, legislation and social inflation may void exclusions or revive claims, extending coverage beyond underwriting intent and raising losses. | 37% | 0% |
| 30 | Changes in accounting standards New or reinterpreted accounting standards may alter reported results and comparability, requiring costly system changes or restatement of prior periods. | 37% | 18% |
Insurers hold large volumes of personal, health and financial data, which helps explain why almost all of them disclose cyber risk. Internal IT system failures (47%), third-party vendor breaches (45%) and outsourced service provider failure (42%) also rank in the top 30, reflecting the industry’s reliance on legacy policy administration systems and outsourced claims and IT services.
The financial block is the heart of the list. Investment portfolio losses, issuer defaults (48%), reinsurer non-payment, reinsurance availability, reserve adequacy, rating downgrades and capital requirements all appear — and almost none of them are disclosed by companies outside insurance. These risks interact: a catastrophe year strains reserves and capital, raises reinsurance prices at renewal and can trigger a rating review, which in turn affects distribution. Flawed pricing, reserving and catastrophe models (46%) sit underneath all of them.
Two near-identical rating risks appear in the table: “credit rating downgrade” (42%) and “financial strength rating downgrade” (41%). Our grouping kept them apart because one focuses on funding and collateral costs and the other on lost business, but in your own register they are best treated as a single risk with both consequences.
What is distinctive about insurers
Fifteen risks meet our test for being distinctive to insurance: disclosed by at least 20% of insurance companies and at least 15 percentage points more often than in any other industry. All fifteen rank in the top 30, and most are disclosed by no company outside the sector. Five matter most for a typical carrier.
Inadequate loss reserves
64% of insurance companies disclose it, against 0% on average in the other industries.
Reserves are an estimate of claims that have not yet been paid, and for long-tail lines such as liability and workers’ compensation that estimate runs years ahead. Social inflation — larger jury awards and litigation funding — and general inflation in repair and medical costs push ultimate losses above early assumptions. The controls are actuarial: regular reserve reviews, independent actuarial opinion, back-testing of prior estimates and clear escalation when development moves outside tolerance.
Reinsurance: counterparty failure, availability and cost
“Insurer or reinsurer failure to pay”: 67% (other industries 1%). “Reinsurance unavailable, inadequate or costly”: 59% (other industries 0%).
Reinsurance moves risk off the balance sheet, but it creates two new exposures: the reinsurer may not pay, and next year’s cover may be unavailable or much more expensive. Manage the first with counterparty limits by rating, collateral for weaker reinsurers and monitoring of disputed recoverables. Manage the second by planning the renewal early, modelling retentions under higher prices and agreeing in advance what the business will do if cover cannot be bought at an acceptable price.
Catastrophe claims exceeding reserves and reinsurance
58% of insurance companies disclose it, against 0% on average in the other industries.
Natural, man-made and terrorist catastrophes, increasingly linked to climate change in the filings, can generate claims beyond what was priced, reserved or reinsured in a single event. The core controls are accumulation management — knowing aggregate exposure by peril and region — catastrophe modelling with explicit allowance for model uncertainty, and a risk appetite that limits probable maximum loss relative to capital.
Investment portfolio losses
76% of insurance companies disclose it, against 9% on average in the other industries.
Insurers invest premiums until claims are paid, so their results depend on the investment portfolio as well as underwriting. Rate rises create unrealised losses on bonds; credit spreads and defaults affect value and income. Asset-liability matching, limits on credit quality and concentration, and liquidity stress tests that assume claims arrive when markets are weak are the standard defences.
Dependence on agents and brokers
54% of insurance companies disclose it, against 0% on average in the other industries.
Most insurers reach customers through independent agents and brokers who can move business elsewhere. Broker consolidation strengthens their bargaining power over commissions and terms. Track premium concentration by distributor, keep relationship ownership clear and treat the loss of a top distributor as a scenario in planning, not a surprise.
The other distinctive insurance risks, including regulation, capital and the two rating risks discussed above:
| Risk | Insurance companies | Other industries (avg) |
|---|---|---|
| Dependence on restricted subsidiary distributions Legal, regulatory or contractual limits on subsidiary dividends leave the holding company without cash to service debt, pay taxes, expenses or shareholder dividends. | 76% | 20% |
| Extensive and changing insurance regulation Extensive and changing insurance regulation may restrict pricing, products and growth, raise compliance costs and bring fines or licence revocation. | 75% | 1% |
| Investment portfolio issuer default Default or downgrade of issuers of fixed-income and other portfolio securities impairs portfolio value, reduces investment income and causes realised losses. | 48% | 1% |
| Flawed quantitative models and data Flawed, misused or poorly specified pricing, valuation, reserving or catastrophe models and data produce inaccurate estimates, causing mispricing, unexpected losses and misstated results. | 46% | 3% |
| Insurance market cycles and capacity shifts Soft market cycles, catastrophes and changes in insurer or reinsurance capacity depress premium rates and volumes and disrupt placement of cover. | 44% | 0% |
| Credit rating downgrade Deteriorating financial strength leads to a credit or financial strength rating downgrade, raising borrowing and collateral costs and restricting access to funding. | 42% | 7% |
| Insurer capital and solvency requirements Failure to meet or rises in risk-based capital and solvency requirements may trigger regulatory intervention, dividend limits and rating downgrades. | 41% | 0% |
| Financial strength rating downgrade A downgrade or loss of financial strength ratings reduces distributor and customer confidence, causing lost business and higher funding and reinsurance costs. | 41% | 0% |
| Legal developments expanding insurance coverage Court rulings, legislation and social inflation may void exclusions or revive claims, extending coverage beyond underwriting intent and raising losses. | 37% | 0% |
The category mix
Every identified company-level risk is classified into one of nine groups. The table shows how insurance companies’ risk mentions split across them — a rough picture of where their attention goes, not of where losses come from.
| Risk group | Share of risk mentions |
|---|---|
| Financial | 30.7% |
| Strategic | 23.2% |
| Compliance and legal | 19.1% |
| Operational | 14% |
| IT and cyber security | 4.9% |
| People | 3.6% |
| ESG and sustainability | 3.2% |
| Reputational | 1.2% |
| Project | 0.2% |
Financial risks lead at 30.7% of mentions, followed by strategic (23.2%) and compliance and legal (19.1%). Reputational risk is a small share (1.2%), although rating downgrades — classified as financial or strategic — carry much of what other industries would call reputation.
How to use this in your own risk register
A benchmark is a checklist of what peers disclose, not a risk assessment of your business. Use it to spot gaps, then do the real work yourself.
- Pick. Read the distinctive risks and the top ten first. Tick the ones that genuinely apply to your business model, size and markets, and drop the rest. Brokers and service firms can drop most reserve, reinsurance and capital items; carriers will usually keep all of them.
- Rewrite for your business. Filing wording is deliberately generic. Turn each risk into a specific statement of cause, event and consequence — see what a risk register is for the format.
- Score likelihood and impact. Score each risk on your own risk matrix. Do not use the share column as a likelihood: it measures how many companies mention a risk, not how often it happens.
- Name an owner and controls. Each risk needs one accountable person and a short list of the controls that actually reduce it today.
- Add indicators. Pick one or two key risk indicators for the risks that score highest, with thresholds that trigger action.
For example, “Catastrophe claims exceeding reserves and reinsurance” becomes: “A major hurricane affecting our coastal homeowners book produces net losses above our reinsurance retention and planned catastrophe load, reducing capital below our target solvency ratio and prompting a rating review.” That version names the peril, the book and the threshold you care about.
Indicators that suit insurers include:
- Probable maximum loss for the main peril as a share of capital, against appetite.
- Prior-year reserve development as a percentage of opening reserves.
- Reinsurance recoverables from reinsurers below your minimum rating.
- Premium written through the five largest distributors.
- Phishing simulation click rate and critical vulnerabilities older than target.
Insurers depend heavily on outsourced claims, IT and data providers; our third-party risk assessment guide covers how to tier and review them. For APRA-regulated insurers in Australia, the CPS 230 guide explains the operational risk standard, and our guide to risk appetite statements shows how to set the limits mentioned above.
Frequently asked questions
What are the biggest risks for insurance companies?
In 97 US insurance annual reports, the most widely disclosed risks are cyberattack (98% of companies), intense competition (91%), restricted subsidiary distributions to the holding company (76%), investment portfolio losses (76%) and extensive and changing insurance regulation (75%).
Which risks are specific to the insurance industry?
Compared with fourteen other industries, insurers almost uniquely disclose inadequate loss reserves, insurer or reinsurer failure to pay, the availability and cost of reinsurance, catastrophe claims, insurance market cycles, dependence on agents and brokers, solvency capital requirements, financial strength rating downgrades, flawed pricing and reserving models, and legal developments that expand coverage.
Do brokers face the same risks as insurers?
Partly. About a fifth of the companies in our sample are agents, brokers and service firms. They share cyber, competition, regulation and acquisition risks with carriers, but not underwriting risks such as reserves, reinsurance and catastrophe claims. A broker should start from the general and distribution risks and skip the balance-sheet items.
How was this list built?
From the Risk Factors section of the latest annual report of 97 US-listed insurance companies on SEC EDGAR. We recorded every distinct risk each section discloses, grouped equivalent risks across companies and counted the share of companies disclosing each one.
Does a higher share mean a risk is more likely?
No. The share measures how many companies chose to disclose a risk, not how often it happens or how much it costs. Annual reports are written by lawyers to protect the company, so they are over-inclusive: a risk can appear in nearly every filing and still be unlikely in any given year. Score likelihood and impact for your own business separately.
Start your register from this benchmark
Risk Samurai uses this benchmark to suggest the risks companies in your industry typically face — reserving, reinsurance, catastrophe, investment and distribution risks for an insurer — when you build your register. You then rewrite, score and assign owners to them.
Get early access