Understanding Risk: Insurable vs. Uninsurable Categories

UPI Study › Courses › System Analysis and Design › Free lessons › Lesson 8.2 Free with a free account

Understanding Risk: Insurable vs. Uninsurable Categories

System Analysis and Design · Chapter 8: Maintenance, Risk, and SecuritySection 8.2 · lesson 54 of 696 min · free with a free account

← Keeping Software Alive: The Maintenance PhaseNext lesson: Security Management: Systems, Tools, and Applications →

Earn 3 college credits for System Analysis and DesignRecommended for credit by NCCRS · Computer Science 390 · self-paced · one payment, lifetime access
Enroll in System Analysis and Design · $250 →Download the syllabus (PDF)

In this lesson

Pure and speculative risk, what makes a risk insurable, and risk transfer.

  • Distinguish pure risk from speculative risk
  • List the criteria that make a risk insurable
  • Apply them to cyber insurance and technology obsolescence
  • Explain insurance as one way of transferring risk

Transcript

Everything said in the video, section by section (800 words). Read along, or search it.

Maintenance, Risk, and Security

Understanding Risk

Every system carries risk. But not every risk can be handled the same way. This section separates pure risk from speculative risk, sets out what makes a risk insurable, and applies that to real I T examples. Finally, it places insurance within the bigger picture, as one way of transferring risk.

2 Kinds of Risk

Pure Risk vs. Speculative Risk

The most basic distinction is between pure risk and speculative risk. A pure risk has only two possible outcomes. Loss, or no loss. It is usually taken involuntarily, as with an accident or a disaster. A server room flood destroying hardware is pure risk. A speculative risk has three possible outcomes. Loss, no loss, or gain. It is taken voluntarily, as a deliberate business decision. Investing in a new, unproven database platform is speculative risk. The key difference is the possibility of gain. A fire either damages a data center or it does not. There is no version where the organization comes out ahead. Adopting an unproven technology might fail, might change nothing, or might give the organization a real competitive advantage. Insurance exists to protect against pure risk. Insurers cannot profitably sell protection against a bet an organization chose to make, in hopes of a reward.

Even Pure Risk Must Qualify

6 Criteria for an Insurable Risk

Even within pure risk, not everything qualifies for insurance. Insurers look for six criteria. First, a large number of similar exposures, so the insurer can pool risk and predict losses statistically. Second, the loss must be accidental. A deliberately caused loss cannot be insured. Third, the loss must be definite and measurable. Its cause, timing, and amount can be clearly established. Fourth, it must not be catastrophic to the insurer. A single event should not trigger claims from every policyholder at once. Fifth, the chance of loss must be calculable. Its probability can be reasonably estimated. And sixth, the premium must be economically feasible, affordable relative to the protection it provides. So a unique piece of custom hardware, the only one of its kind in the world, fails the first criterion. The insurer has no similar cases to learn from.

Figure 1

Classifying a Risk

Putting the two ideas together gives a simple way to classify any risk. Start by asking whether there is any chance of gain. If yes, the risk is speculative, and generally uninsurable. If no, it is a pure risk. But that is not the end of the question. Next, ask whether it meets the insurability criteria. If it does, it is insurable. If it does not, it is a pure risk that still cannot realistically be insured. A new product built on an experimental technology stack stops at the first question. It could succeed, so it is speculative.

IT Examples

Cyber Insurance and Obsolescence

Now apply the criteria to two I T risks. Cyber insurance, covering data breaches, ransomware, and business interruption from an attack, is generally insurable. A large pool of similar businesses faces comparable exposure, and losses are typically accidental and measurable. There is one caveat. A single attack on a vendor that many customers share can strain the catastrophe criterion, and complicate pricing. Technology obsolescence, a system becoming outdated or unsupported, is generally not insurable. It can be costly. But the decline is gradual and foreseeable, rather than a discrete, accidental event. So organizations manage it through planned upgrades and maintenance budgets instead.

Risk Transfer

Insurance Shifts the Cost, Not the Event

Buying insurance is one specific way of handling risk. It transfers the financial burden of a potential loss to an insurer, in exchange for a premium, rather than carrying that burden directly. Notice what that means. Insurance does not stop the flood or the breach from happening. It shifts who pays if it does. Transfer is not the only option. A risk can also be avoided entirely, reduced by lowering its likelihood or impact, or simply accepted. Choosing among these options is part of the complete risk management process, covered later in the course. The focus here is narrower. Knowing which risks are even candidates for the transfer that insurance provides.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. A pure risk has only two outcomes, loss or no loss, with no possibility of gain. A speculative risk has three outcomes. Loss, no loss, or gain. An insurable risk is a pure risk that meets an insurer's criteria. And risk transfer shifts a risk's financial burden to another party, such as an insurer, in exchange for a fee.

Key Takeaways

What to Carry Forward

To pull this together. Pure risk allows only loss or no loss. Speculative risk also allows for gain, and insurance generally covers only pure risk. An insurable risk needs many similar exposures, an accidental and measurable loss, a non-catastrophic scope, a calculable probability, and a feasible premium. Cyber insurance generally meets these criteria. Technology obsolescence generally does not, because its decline is gradual and foreseeable. And insurance is one way of transferring risk. It is not the same thing as an organization's complete risk management process.

About System Analysis and Design at UPI Study

System Analysis and Design (Computer Science 390) is a self-paced online course of 69 video lessons in 9 chapters, from the analyst's role and requirements to UML modeling, interface and database design, testing, maintenance and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take System Analysis and Design with UPI Study

From business problem to working systemSystem Analysis and Design teaches how analysts study a business need and turn it into a system design: requirements, UML and data-flow models, interface and database design, implementation and project management. It is a core course in information systems and IT degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

System Analysis and Design carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Understanding Risk: Insurable vs. Uninsurable Categories

What is the difference between pure risk and speculative risk?
A pure risk has two possible outcomes, loss or no loss, while a speculative risk has three: loss, no loss, or gain. Pure risks are usually involuntary, such as a flood destroying a server room. Speculative risks are chosen deliberately, such as investing in an unproven database platform that might fail or might bring a competitive advantage. Insurance is designed to cover pure risk.
What makes a risk insurable?
A pure risk is insurable when it meets six criteria. There must be a large number of similar exposures so losses can be predicted, and the loss must be accidental. It must be definite and measurable, and not catastrophic to the insurer, meaning one event should not trigger claims from every policyholder at once. The chance of loss must be calculable, and the premium must be economically feasible.
Is technology obsolescence an insurable risk?
Technology obsolescence is generally not insurable, because a system becoming outdated or unsupported is a gradual, foreseeable decline rather than a discrete, accidental event. Organizations manage it through planned upgrades and maintenance budgets instead. Cyber insurance, by contrast, is generally insurable, since many similar businesses face comparable exposure to breaches and ransomware and losses are typically accidental and measurable.
Does buying insurance reduce the chance of a loss?
No, insurance transfers the financial burden of a loss to an insurer in exchange for a premium; it does not stop the flood or breach from happening. It is one form of risk transfer. Other ways of handling a risk include avoiding it entirely, reducing its likelihood or impact, or accepting it. Insurance is therefore one tool within a broader risk management process.

About the System Analysis and Design course

How many college credits is System Analysis and Design?
System Analysis and Design (Computer Science 390) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does System Analysis and Design cost and what is included?
$250, paid once, with lifetime access: all 69 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does System Analysis and Design take?
It is self-paced with no deadlines. The 69 lessons total about 9 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in System Analysis and Design.

69 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in System Analysis and Design →Download the syllabusEvery course with PRO →
System Analysis and Design
3 credits · NCCRSEnroll →