Appendix F — Catastrophe and Reinsurance Reference

Two subjects decide whether a property book survives the year it cannot afford: how you measure the loss a single catastrophe could do to your portfolio, and how you arrange for someone else to carry the part of that loss you cannot. This appendix is the field reference for both. It does not replace the chapters that teach them — catastrophe modeling and accumulation management in Chapter 30, reinsurance in Chapter 27, and the capital those tools protect in Chapter 28 — it condenses them into one place you can return to when a treaty wording is on your desk or a model output is in your inbox.

A word before the numbers. Every figure in this appendix is a constructed teaching example, chosen to make a structure legible, never to state a market price, a vendor's model output, or a real insurer's exposure. The structures are real; the numbers attached to them are illustrative. When you see "\$5M xs \$5M," read it as a shape, not a quote.

Part 1 — Catastrophe modeling

Why catastrophe needs its own apparatus

Ordinary risk pooling rests on independence: a thousand fires in a thousand towns are a thousand separate draws, and the law of large numbers makes their average predictable. A catastrophe peril breaks that assumption. One hurricane damages ten thousand insured homes from a single event; the losses are not independent draws but one correlated event with ten thousand faces. The catastrophe is not the average of those losses — it is the correlation among them. That is why an insurer cannot estimate hurricane loss from its own history the way it estimates fire loss: it has thousands of fire years on the books and only a handful of major-hurricane years, and the next one will not look like the last.

The response is to simulate the experience the company cannot observe. A catastrophe model generates tens of thousands of physically plausible events — a stochastic event set — runs each one against the specific properties on the books, and produces a full distribution of what those properties would lose. It substitutes simulated centuries for the few real years an insurer has lived through. Hurricanes Andrew (1992) and Katrina (2005) are the public reference points for why the industry built this machinery: each revealed that the prior generation of tools had badly understated the loss a single storm could do.

The three modules

Every catastrophe model is three linked engines. Knowing which module a question lives in tells you whom to ask and how much to trust the answer.

INSIDE A CATASTROPHE MODEL — the three modules        [schematic, not to scale]

  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
  │   HAZARD     │ →  │ VULNERABILITY│ →  │  FINANCIAL   │
  │              │    │              │    │              │
  │ where, how   │    │ how much     │    │ who pays     │
  │ often, how   │    │ damage that  │    │ how much,    │
  │ intense the  │    │ intensity    │    │ after        │
  │ peril is     │    │ does to THIS │    │ deductibles, │
  │ (the science │    │ building     │    │ limits, and  │
  │  of the      │    │ (damage      │    │ reinsurance  │
  │  peril)      │    │  functions)  │    │              │
  └──────────────┘    └──────────────┘    └──────────────┘
        │                   │                    │
   stochastic          damage ratio         ground-up loss
   event set           per location         → gross → net

• The hazard module answers where, how often, and how intense. For wind, it is the simulated catalog of storms — their tracks, central pressures, wind fields, and storm surge. For earthquake, the fault sources, magnitudes, and the way ground shaking attenuates with distance and soil. This is the geophysics, and it is where the deepest scientific uncertainty lives, because the historical record of extreme events is short relative to their return periods.
• The vulnerability module translates an intensity at a location into a damage ratio — the fraction of the property's value the event destroys — through damage functions keyed to the building's characteristics. This is where the COPE data you collected (Chapter 9) earns its keep: construction, occupancy, age, roof type, number of stories, and the secondary modifiers (roof-to-wall connections, shutters, the year the building code changed) move the damage function. Garbage in, garbage out applies with force here. A model run on a portfolio coded "construction unknown" is a model run on assumptions, and the assumptions are conservative for a reason.
• The financial module turns physical damage into insured loss by applying the policy structure — deductibles (including the percentage named-storm deductibles of Chapter 15), limits, sublimits, coinsurance — and then the reinsurance, producing loss on a ground-up, gross (after policy terms, before reinsurance), and net (after reinsurance) basis. The same event produces three very different numbers depending on where in this module you read it.

The model vendors, as a category. A small number of specialized firms build and license the major commercial catastrophe models the industry relies on; carriers, reinsurers, and brokers run their portfolios through one or more of them, and many run several and compare. The reference points you need to remember are not the vendors' names or their numbers but two disciplines: never treat a single model's output as truth (different models embed different science and disagree, sometimes materially, on the same portfolio), and never confuse a precise-looking number with a certain one. A 1-in-100 loss quoted to the dollar is a point estimate drawn from a distribution that is itself uncertain.

The key metrics

A model produces a loss distribution. The metrics below are the handful of summary numbers the industry reads off that distribution. The cardinal error is to confuse the two that answer different questions — AAL answers "what do we charge?" and PML answers "how bad is the bad case we must survive?"

Average annual loss (AAL). The mean of the entire catastrophe loss distribution — the long-run expected catastrophe loss per year if the portfolio could be played out over thousands of years. It is the catastrophe pure premium: the piece of the rate that must fund the cat exposure, loaded into the price exactly as any other expected loss is. In a normal year, actual cat losses come in below the AAL; in the rare bad year, far above it. The AAL is what makes the long-run arithmetic work, even though no single year resembles it.

Probable maximum loss (PML). A loss read far out in the tail of the distribution — the loss the portfolio would exceed only with a specified small probability, quoted at a chosen return period. It answers the survival question, and it is the number reinsurance and capital are sized against. Because the word "PML" is used loosely across the market, always specify three things: the return period, whether it is per-occurrence (one event) or annual aggregate (all events in a year), and whether it is gross or net of reinsurance. A "PML of \$80M" with none of those three stated is not yet a usable number.

The exceedance-probability (EP) curve. The whole picture from which AAL and PML are drawn: a curve plotting, for every loss level, the annual probability that losses exceed it. PML is a single point read off this curve; AAL is the area under a related representation of it. Two flavors matter: the occurrence EP (OEP) curve answers "what is the chance any single event exceeds \$X this year?" and is the right tool for sizing per-event catastrophe reinsurance; the **aggregate EP (AEP)** curve answers "what is the chance the *sum of all events* this year exceeds \$X?" and matters for capital and for aggregate covers.

EXCEEDANCE-PROBABILITY CURVE (occurrence)        [constructed teaching example]

 annual P(loss > L)
   1.0 ┤██
       │ ███
  0.10 ┤   ████              ← 1-in-10  (10% / year)   loss ≈ \$22M
       │      █████
  0.04 ┤         █████       ← 1-in-25  (4% / year)    loss ≈ \$41M
  0.01 ┤            ███████   ← 1-in-100 (1% / year)   loss ≈ \$80M
 0.004 ┤                 ████ ← 1-in-250 (0.4%/year)   loss ≈ \$120M
       └────┬────┬────┬────┬────┬────────────────────  loss L (\$M)
           20   40   60   80  120

The curve above is illustrative, but read what it teaches. Loss grows steeply as the probability shrinks: the 1-in-250 loss is far more than 2.5 times the 1-in-100 loss. The tail is where catastrophe lives, and small changes in the assumed return period move the dollar figure a great deal — which is exactly why the choice of return period is a governance decision, not a technicality.

Return periods and the 1-in-100-year event. The return period is the inverse of the annual exceedance probability stated as a frequency: a 1% annual exceedance probability is the "1-in-100-year" loss. The single most misunderstood idea in this whole subject is what that phrase means. A return period is a probability per year, with no memory — not a fixed schedule. A "1-in-100-year" event does not arrive on a hundred-year timetable. It has a 1% chance each year, independent of last year; it can strike twice in a decade; and over a 30-year mortgage it has roughly a 26% chance of occurring at least once ($1 - 0.99^{30}$). An insured who hears "100-year flood" and concludes "not in my lifetime" has misread the number, and so has any underwriter who lets the framing lull the book.

The trap in the tail. The most dangerous sentence in catastrophe work is "we haven't had one in years." Quiet years do not lower the probability — they are draws from the same urn. A book priced as if the absence of recent catastrophe were evidence of low catastrophe risk is mispriced, and the correction arrives all at once. The disciplined underwriter prices the AAL every year, including the years nothing happens, because the AAL is the cost of the rare event spread across the calm ones.

Accumulation management by peril zone

The model tells you what your portfolio would lose. Accumulation management is the operational discipline that keeps that number survivable: the systematic measurement and control of total exposure to a single event, organized by peril zone, so that no one event can produce a loss the company cannot absorb. Where individual risk selection asks "is this account good?", accumulation management asks "how much of the same bet am I already holding?"

The unit is the peril zone — a geographic band within which properties would be hit by the same event. Industry practice has long used standardized zones (the CRESTA zone scheme is the common reference) so that carriers, reinsurers, and brokers measure concentration on the same map. The point is correlation: two plants on opposite coasts are diversified against hurricane; two plants in the same coastal county are one storm's worth of loss wearing two policy numbers.

The mechanics:

• Set a zone limit. For each peril zone, the carrier sets a maximum tolerable aggregate exposure (often expressed as a maximum modeled PML contribution from that zone), derived from its capital and its reinsurance program.
• Measure each account's marginal contribution. A new submission is judged not only on its standalone quality but on what it adds to the zone. The same well-run plant is a fine risk in an empty zone and an unwelcome one in a zone already at its limit — accumulation management routinely declines individually good accounts because the book cannot hold more of that correlated bet.
• Aggregate up the financial module. The statement of values (SOV) for every account in the zone feeds the model, and the zone's combined OEP/AEP tells you the event loss you are carrying gross, and — after the catastrophe reinsurance below — net.

PERIL-ZONE ACCUMULATION (one wind zone)        [constructed teaching example]

  zone limit (max tolerable PML contribution)      ████████████████  \$100M
  already on the books (modeled 1-in-100 gross)    ████████████      \$78M
  headroom remaining                               ███               \$22M
  ── new Harbor Steel submission would add ──       ██  +\$9M  → \$87M  (within limit)

The figure is illustrative, but the logic is the live one for the running project: Harbor Steel sits in a hurricane-exposed Gulf Coast county, and its acceptability depends partly on how full that zone already is — exactly the marginal-contribution test Chapter 30 applies to it.

The protection gap

Not all catastrophe loss is insured loss. The protection gap is the portion of total economic catastrophe losses that no insurance covers — borne instead by households, businesses, and governments. It is widest precisely where catastrophe risk is highest and least affordable, and it marks the practical limit of insurability at current prices and tools. Flood is the starkest case: most flood loss in the United States is uninsured, despite the National Flood Insurance Program (NFIP), because take-up is low and the peril is concentrated.

The gap is not a fixed fact; it moves as four things change — pricing freedom (whether regulators allow risk-based rates), mitigation (building codes, defensible space, elevation), capital (how much risk-bearing capacity the market and reinsurance supply), and public-private backstops (programs like the NFIP, state wind pools, and residual markets). The California wildfire insurability strain is the live illustration: where the adequate price outruns the price a regulator will approve or an insured will pay, coverage withdraws and the gap widens — an availability/affordability failure rather than a modeling failure. A perfectly modelable risk is not always a writable one.

Part 2 — Reinsurance

The cedent and the reinsurer

No carrier holds all of its risk. Reinsurance is insurance purchased by an insurer: a contract under which one insurer (the reinsurer) agrees, for a premium, to indemnify another (the ceding company, or cedent) for all or part of the losses the cedent incurs under the policies it has written. Reinsurance exists for four reasons that map directly onto the underwriting decisions of Part V: capacity (to write limits larger than the cedent's own balance sheet should hold), catastrophe protection (to survive the correlated event the model just sized), stability (to smooth the year-to-year volatility of the result), and surplus relief (to free up capital to write more business — Chapter 28).

One fact governs everything else: the original policyholder's contract is untouched, and the cedent remains fully liable to that policyholder whether or not the reinsurer pays. Reinsurance is an agreement between the two insurers; the insured is not a party to it and usually never learns it exists. That is why a reinsurer's financial strength — its collectability — is part of the cedent's own risk: if the reinsurer cannot pay, the cedent still must, and a recoverable that cannot be collected is an asset that was never really there. The cedent underwrites its reinsurers (their AM Best rating, their concentration, their willingness to pay) as carefully as it underwrites its insureds.

Treaty vs. facultative — how reinsurance is arranged

The first fork is how the deal is struck.

• Treaty reinsurance covers a whole defined class or book automatically and obligatorily. Terms are negotiated once, typically at annual renewal, and thereafter every qualifying risk is ceded the moment the cedent binds it — no individual offer, no individual acceptance. Treaty is the workhorse: it is how a carrier reinsures its book as a portfolio.
• Facultative reinsurance is arranged one specific risk at a time and is optional for both parties: the cedent chooses whether to offer a particular risk, and the reinsurer chooses whether to accept it. Facultative is the scalpel — used for a single account that is too large for the treaty, falls outside it, or needs extra capacity. The running example makes the contrast concrete: the treaty handles Harbor Steel's catastrophe exposure automatically, but the question of whether the \$20M property line needs additional placement is a facultative question, decided risk by risk.

Proportional vs. non-proportional — how the loss is shared

The second fork is how losses and premiums are split. This is the distinction that organizes every treaty.

Proportional (pro-rata) reinsurance shares premiums and losses in the same proportion, from the first dollar. The reinsurer takes a defined share of the original premium and pays that same share of every loss. Because the reinsurer is sharing the original premium, it pays the cedent a ceding commission (below).

• Quota share. The reinsurer takes a fixed percentage of every risk in the covered book — say 30% — receiving 30% of all premiums and paying 30% of all losses, large and small alike. Quota share is the best tool for surplus relief and funding growth, because it cedes premium (and the capital strain that premium creates) proportionally across the whole book. Its limitation is bluntness: it cedes the same share of a tiny risk the cedent could easily keep as of a large risk it genuinely needs help with.
• Surplus share. A proportional treaty that cedes only the part of each risk above the cedent's chosen retention, expressed in multiples of that retention called lines. The cedent keeps its full retention on every risk and cedes only the genuine excess, so premiums and losses on a ceded risk split in the same proportion as the division of the limit. Surplus share lets the cedent homogenize its net book — keep the same net amount on a small risk and a large one — which quota share cannot do.

Non-proportional (excess-of-loss) reinsurance does not share premiums and losses in fixed proportion. Instead the reinsurer pays the part of a loss above the cedent's retention, up to the reinsurer's limit. The cedent keeps all losses below the retention and all premiums except the (separately priced) reinsurance premium; there is no ceding commission, because the reinsurer is not sharing the original premium. Excess of loss caps the cedent's loss and protects against severity, which proportional reinsurance does not.

• Per-risk excess of loss. Responds to a single large risk — one big claim on one policy. Written in stacked layers described as "limit excess of retention": "\$4M xs \$1M" means the reinsurer pays the band from \$1M up to \$5M on any one risk, and the cedent retains the first \$1M. It protects the individual large loss.
• Catastrophe excess of loss (cat XOL). Responds not to a single large risk but to the aggregate loss to the cedent's whole book from a single catastrophe event — one hurricane, earthquake, or wildfire — above the cedent's event retention. This is the instrument that addresses correlated catastrophe loss, the failure of the independence assumption that Part 1 of this appendix is about. It is sized against a modeled return period: a cedent buys cat XOL up toward, say, its 1-in-250 OEP so that the event it must survive is reinsured above its retention. Per-risk XOL would not respond to a catastrophe the right way, because a catastrophe is many modest losses at once rather than one enormous loss — which is exactly why cat XOL exists as a separate cover.

The vocabulary of a layer: retention, attachment, limit

Three words describe any excess-of-loss cover, and they recur on every treaty wording.

• Retention (also the attachment point or priority): the amount of loss the cedent keeps before the reinsurer pays anything. Below it, the cedent is on its own.
• Attachment point: the loss level at which the reinsurance begins to respond — the top of the retention.
• Limit: the most the reinsurer will pay in that layer. Above the limit, the cedent is exposed again (until the next layer up attaches).

So "\$5M xs \$5M" attaches at \$5M, has a \$5M limit, and covers the band from \$5M to \$10M; a loss of \$12M leaves \$2M for the cedent above that layer (unless a higher layer is bought). Reading a tower is just reading these three numbers, layer by layer.

The reinsurance tower

A reinsurance program is built in layers stacked vertically, each attaching where the one beneath it exhausts. The picture below is the canonical way the industry draws it — the reinsurance tower.

REINSURANCE TOWER — one carrier's property-catastrophe program   [constructed teaching example]

   loss to
   the book
   (\$M)
   ▲
250├───────────────────────────────────────────────┐
   │   ░░░░░  UNREINSURED TAIL (cedent's net)        │  above the program: the cedent
   │   ░░░░░  — and where retrocession may sit ─────►│  carries it (or buys more)
200├───────────────────────────────────────────────┤
   │   ▓▓▓▓▓  LAYER 3:  \$100M xs \$100M             │  cat XOL — remote, cheapest rate-on-line
100├───────────────────────────────────────────────┤
   │   ▓▓▓▓▓  LAYER 2:   \$50M xs  \$50M             │  cat XOL — working upper layer
 50├───────────────────────────────────────────────┤
   │   ▓▓▓▓▓  LAYER 1:   \$40M xs  \$10M             │  cat XOL — first layer above retention
 10├───────────────────────────────────────────────┤
   │   █████  RETENTION (net, every event):  \$10M  │  the cedent keeps the first \$10M
  0└───────────────────────────────────────────────┘
                                                        ◄── a single event's loss climbs
                                                            from the floor up the tower

Read the tower from the ground up, the way a loss climbs it. A modeled hurricane produces an aggregate loss to the book; the first \$10M is the cedent's retention** (its net loss on any event); from \$10M to \$50M, **Layer 1** pays; from \$50M to \$100M, **Layer 2**; from \$100M to \$200M, **Layer 3**. A \$140M event is fully covered to \$200M and the cedent's net is just its \$10M retention plus any co-participation. A \$240M event exhausts the program, and the \$40M above \$200M falls back on the cedent — which is why the height of the tower is a capital decision tied directly to the EP curve: a carrier buys up toward the return period it must survive, and the modeled 1-in-100 or 1-in-250 PML is what tells it how tall to build. Layers higher in the tower attach less often and therefore cost less per dollar of limit (a lower rate on line); the bottom layer, which is hit most often, is the most expensive. Brokers place each layer with a panel of reinsurers, and a single layer is usually shared horizontally among several reinsurers each taking a percentage — so the tower has width as well as height.

This is also where the running project's catastrophe exposure resolves: Harbor Steel's property loss in a Gulf storm does not sit alone on the cedent's balance sheet. It enters the book's aggregate event loss, climbs this tower, and is retained net only up to the event retention — the net vs. gross distinction that Chapter 27 applies to the file, and the reason a single catastrophe-exposed account is judged by its contribution to the zone and the tower, not by its standalone merits.

Retrocession and the limits of passing on risk

Reinsurers reinsure too. Retrocession is reinsurance purchased by a reinsurer: the reinsurer (the retrocedent) transfers part of the risk it has assumed to another reinsurer (the retrocessionaire), for the same reasons a primary insurer cedes in the first place — capacity, catastrophe protection, stability. Retrocession spreads catastrophe risk more widely across the global market, which is healthy.

But it has a failure mode worth naming. If the chain of who-reinsures-whom becomes opaque, and participants end up reinsuring one another in a circle, a single catastrophe can travel around the loop and amplify — the loss returning, magnified, to firms that thought they had passed it on. The lesson generalizes the collectability point: risk transfer is only as sound as the counterparty at the far end of it. You can cede a loss; you cannot cede the obligation to your own policyholder, and you cannot cede away the possibility that the party you ceded it to fails. The 2008 crisis and AIG are the public reminder of what happens when a guarantee-writing chain outruns the capital and the transparency behind it.

Quick reference — the one-line versions

Cross-references: catastrophe modeling, the metrics, accumulation management, and the protection gap are developed in Chapter 30; the reinsurance forms, the tower, and net-vs-gross underwriting in Chapter 27; and the capital and solvency framework these tools protect — surplus, RBC, Solvency II, the cost of capital — in Chapter 28. The Harbor Steel catastrophe and reinsurance treatment runs through the Underwriting-File checkpoints of those three chapters.