Category: Underwriting & Risk Selection

Loss History Review

Also known as: Loss Run Review, Claims History Review, Loss Run Report Review

Simply put

A loss history review is the process of examining an organization's past insurance claims, usually documented in a loss run report generated by the insurer. This report summarizes claims previously filed against a policy over a set period, or states that no losses occurred if none were filed. Reviewing it gives a business a clearer picture of its claims history and how that history may affect its insurance.

Formal definition

A loss history review is the evaluation of an insured's prior claims experience, typically drawn from a loss run report produced by the insurance carrier that summarizes claims made against a policy over a defined period (often several years). The review examines the frequency, nature, and disposition of past claims to inform underwriting, pricing, and renewal decisions, and to identify how prior losses may contribute to an organization's risk profile. It is an underwriting and risk-assessment input rather than a coverage term; it does not itself determine whether any future loss will be covered, which remains subject to the specific policy wording, exclusions, and conditions. Where no claims have been filed, the loss run report will indicate no losses. The precise reporting period and format vary by insurer and line of business.

Why it matters

A loss history review is one of the primary ways an underwriter forms a view of an organization's risk before offering or renewing cyber coverage. The loss run report summarizes claims previously filed against a policy over a defined period, and reviewing it gives both the insurer and the insured a clearer picture of the organization's claims history and how prior losses may contribute to its risk profile. Because underwriting, pricing, and renewal decisions draw on this information, an organization that understands its own loss history is better positioned to anticipate how it may be assessed in the market.

It is important to keep the purpose of the review in proportion. A loss history review is an underwriting and risk-assessment input, not a coverage term. It does not by itself determine whether any future loss will be covered; that remains subject to the specific policy wording, exclusions, and conditions of the policy ultimately issued. A clean loss run showing no prior claims is not a guarantee of coverage for a future incident, and a history of prior claims does not automatically mean a future claim will be excluded. The two questions are distinct.

The review also functions differently from actual risk reduction. Examining past claims can inform how an organization is priced and can highlight patterns worth addressing, but the review itself does not reduce the likelihood or severity of a future incident. Any improvement in an organization's resilience comes from the controls, continuity planning, and mitigation work it undertakes, not from the act of reviewing its loss history.

Who it's relevant to

Underwriters

Underwriters use the loss history review as a core input when assessing an applicant or renewal. Examining the frequency, nature, and disposition of prior claims helps inform pricing and terms, but the review is distinct from the coverage decision, which is governed by the policy wording, exclusions, and conditions ultimately applied.

Insurance Brokers

Brokers request and interpret loss run reports on behalf of clients and use them to position an account in the market. Understanding how reporting periods and formats differ across carriers helps brokers present a client's claims history accurately and set realistic expectations about pricing and terms.

Risk Managers

Risk managers reviewing their organization's own loss runs gain a clearer picture of claims history and how prior losses may contribute to the organization's risk profile. This supports renewal preparation, though risk managers should treat the review as an assessment input rather than a substitute for the mitigation and resilience work that actually reduces future exposure.

Chief Information Security Officers

CISOs may be asked to contextualize the technical circumstances behind past cyber claims that appear in a loss run. While the report itself is an insurance document rather than a security metric, the incidents it records can point to areas where security controls and resilience planning warrant attention.

Inside Loss History Review

Prior Claims Disclosure

The applicant's account of past insurance claims, typically covering both first-party losses (such as business interruption or data restoration costs) and third-party liability matters (such as privacy claims or regulatory defense). Underwriters use this to assess the frequency and severity of an applicant's historical loss experience.

Incident and Near-Miss Records

Documentation of past cyber events, breaches, extortion demands, or system outages, whether or not they resulted in a formal claim. This helps distinguish an applicant's actual loss experience from the claims that happened to be insured at the time.

Loss Cause and Root-Cause Detail

Information on how each loss occurred, which informs whether recurrence is likely and whether exclusions (such as failure-to-maintain-standards) might apply to future events of a similar nature. Subject to the specific policy wording, unresolved root causes may affect coverage terms.

Remediation and Control Improvements

Records of corrective actions taken after prior incidents. These are security and resilience measures rather than policy terms, but underwriters review them to gauge whether the underlying likelihood of recurrence has been reduced.

Reporting Period and Retroactive Considerations

The time span the review covers and how it interacts with claims-made triggers, prior-and-pending litigation dates, and retroactive dates in the proposed coverage. Whether a historically known matter is covered depends on the specific policy wording and any applicable exclusions or conditions.

Common questions

Answers to the questions practitioners most commonly ask about Loss History Review.

Does a clean loss history guarantee lower premiums or broader coverage?

No. A loss history review is one input among many. Underwriters typically weigh loss history alongside controls, industry, revenue, data sensitivity, and market conditions. A favorable claims record may support more competitive terms, but it does not by itself guarantee reduced premiums or broader coverage, and pricing remains subject to the insurer's overall appetite and the specific policy wording offered.

Is a loss history review the same as a security or resilience assessment?

No. These are distinct exercises. A loss history review is an underwriting and risk-transfer activity that examines prior incidents, claims, and losses to inform pricing and terms. A security or resilience assessment evaluates controls, frameworks, and recovery capabilities to reduce the likelihood or impact of future incidents. A clean loss history does not demonstrate strong controls, and strong controls do not erase a documented loss history; the two provide different information.

How far back should a loss history review typically go?

The look-back period is set by the insurer and can vary by market and line of coverage; there is no single universal standard. Applications commonly request several years of prior claims and incident information, but the exact period depends on the insurer's form and requirements. Applicants should confirm the specified timeframe on the application and clarify whether it covers claims made, incidents occurring, or losses paid within that window.

What types of events should be disclosed in a loss history review?

Applicants should disclose what the application actually asks for, which typically includes prior claims, reported incidents, and known circumstances that could give rise to a claim. Because forms differ, it is important to read whether the question captures only paid claims, or also reported events, regulatory inquiries, and near-misses. When uncertain about scope, applicants should seek clarification rather than assume an event is excluded, since nondisclosure can affect coverage.

How does incomplete or inaccurate loss history disclosure affect a policy?

Material misrepresentation or nondisclosure in the application can have serious consequences, potentially including rescission or a denied claim, subject to the specific policy wording, applicable warranties or conditions, and jurisdiction. The precise effect varies because legal treatment of misrepresentation differs across regimes. Applicants generally benefit from documenting the basis for their responses and involving their broker to confirm that disclosures are complete and accurate.

Who within an organization should compile the information for a loss history review?

Because relevant events may sit with different functions, compiling accurate loss history often involves coordination among risk management, legal or compliance, IT and security, and finance. Risk or IT may hold incident records, legal may track regulatory inquiries and claims, and finance may hold records of losses paid. Coordinating these sources helps ensure that the disclosure reflects the full picture the application requests, subject to the timeframe and definitions specified by the insurer.

Common misconceptions

A clean loss history means future losses will be covered.

Loss history informs underwriting and pricing, not the scope of coverage. Whether any future loss is paid depends on the policy wording, endorsements, exclusions, conditions precedent, and jurisdiction, regardless of how favorable the applicant's past record appears.

Only formally insured claims need to be disclosed in a loss history review.

A meaningful review typically considers incidents, near-misses, and losses that were self-funded or uninsured, not just prior insured claims. Omitting known but uninsured events can affect the accuracy of the risk picture and, subject to policy conditions and applicable law, may bear on the insurer's response to later claims.

Loss history review measures an organization's resilience.

It is an underwriting and risk-assessment exercise, not a resilience metric. It does not measure recovery time objective, recovery point objective, or business continuity capability, and a favorable loss history does not by itself indicate that continuity or disaster recovery arrangements are adequate.

Best practices

Disclose past losses completely and accurately, including uninsured incidents and near-misses, since material omissions can undermine the reliability of the risk picture and, subject to policy conditions and jurisdiction, may affect later claims.

Separate first-party losses (such as business interruption or data restoration) from third-party matters (such as privacy claims or regulatory defense) in your records so underwriters can assess each category on its own terms.

Document the root cause of each prior loss and the specific remediation taken, recognizing that these controls are mitigation measures distinct from the coverage a policy provides.

Reconcile the review period against proposed policy triggers, retroactive dates, and prior-and-pending dates, and confirm in writing how known prior matters are treated under the specific wording rather than assuming they are covered.

Maintain a consistent internal loss and incident register so that submissions remain accurate over successive renewals and across different insurer application forms.

Treat the review as an underwriting input, not evidence of resilience, and pair it with independent assessment of continuity and recovery capabilities where those questions matter to the organization.