Insurance Portfolio Stress Testing: Climate, Geopolitical, and Regulatory Scenarios for Indian Boards

Audit committees at Indian listed companies routinely receive a quarterly risk register and an annual insurance renewal summary. Until 2022 these two documents lived in parallel: the risk register identified enterprise risks, the insurance summary listed the policies bought, and the link between them was taken on faith. The 2023 LODR amendments requiring quarterly risk management committee meetings for the top 1,000 listed entities, combined with the SEBI (Listing Obligations and Disclosure Requirements) Amendment 2024 on risk disclosure, have tightened the expectation. Boards now ask: if scenario X happens, what does the insurance programme actually pay, and what is the residual loss the company carries?

The question is sharper after three real-world precedents. The October 2024 floods in Chennai produced insured losses of approximately INR 1,200 crore and uninsured losses estimated at INR 9,000 crore; several listed manufacturers disclosed material uninsured damage in their Q3 results. The Red Sea shipping disruption from December 2023 through 2025 caused marine premium increases of 3-5x for India-EU routes and revealed that many trade credit policies had sub-limits on single-country exposure that companies had not modelled. The 2025 global coal underwriting withdrawals by reinsurers left at least four listed Indian power companies scrambling for capacity mid-year and forced disclosure of insurance cost increases in annual reports.

Each event sent the same signal to Indian boards: the insurance programme is a financial instrument whose payoffs depend on scenario-specific conditions, and the board needs to understand those conditions before a crisis, not during one. Insurance stress testing is the structured exercise that translates risk register entries into insurance programme responses and identifies the gaps.

This post presents a framework that large Indian corporates can use for board-level insurance stress testing. It covers scenario design (multi-peril nat-cat, geopolitical, regulatory, systemic cyber), methodology (PML aggregation, realistic disaster scenarios, coverage gap mapping, reinstatement limits), and deliverables (a board risk report format, residual risk quantification, trigger points for programme restructuring). The framework fits an annual board process with quarterly updates, and aligns with SEBI's expected risk disclosure cadence.

The most common single-peril stress test is a 1-in-250 year flood or earthquake at the largest single site. The more revealing test, and the one boards should ask for, is a multi-peril test: what happens if a monsoon flood and an earthquake happen in the same balance-sheet year, hitting different sites.

The probability of two independent 1-in-100 year events in one year is approximately 1.99% (two independent Poisson events at 1% each). For a group with facilities across seismic zones and flood-prone areas, this compound scenario is not a 1-in-10,000 year event; it is closer to 1-in-50. Reinsurers know this and price their aggregate covers accordingly, but many corporate buyers design their insurance programmes on per-event rather than aggregate logic, and discover the gap only during a difficult year.

A worked example: an Indian pharmaceutical company has three manufacturing sites. Site A in Baddi (Himachal, Seismic Zone IV), replacement value INR 800 crore, earthquake PML 65%. Site B in Hyderabad (Zone II), replacement value INR 600 crore, limited nat-cat exposure. Site C in Ahmedabad (Zone III, Sabarmati river floodplain), replacement value INR 500 crore, 100-year flood PML 40%. Single-peril insurance programme: property cover INR 2,000 crore per event.

Compound scenario: magnitude 6.8 earthquake at Baddi in June causes INR 520 crore loss at Site A, and a 100-year Sabarmati flood in August causes INR 200 crore loss at Site C. Per-event limits are adequate for each. But the property policy has an annual aggregate sub-limit on nat-cat of INR 600 crore. After the first event, INR 520 crore of the aggregate is exhausted. The flood loss of INR 200 crore exceeds the remaining INR 80 crore of aggregate, leaving INR 120 crore uninsured. Separately, reinstatement of the nat-cat limit after the earthquake may not have been purchased, or may cost INR 25-40 crore of additional premium depending on policy terms.

The stress test output is precise: INR 120 crore residual uninsured loss plus INR 30 crore of reinstatement premium, total financial impact INR 150 crore. This is the number the CFO should discuss with the board, and the trigger for reconsidering the aggregate sub-limit or purchasing automatic reinstatement cover at renewal. The same framework applies to manufacturing, power, and logistics portfolios with sites in multiple peril zones.

Geopolitical stress tests examine how insurance programmes respond to sudden disruption of trade routes, supplier networks, or contract performance. The three scenarios most relevant to Indian corporates in 2026 are a Red Sea closure extending beyond 90 days, a Taiwan Strait disruption affecting semiconductor and electronic component supply, and a renewed India-Pakistan border tension triggering war-risk policy exclusions.

Red Sea closure scenario: the December 2023 to 2025 Houthi attacks on Red Sea shipping showed that marine war premium on the India-Europe route rose from 0.05% of cargo value to 0.6-1.2%. For an Indian textile exporter shipping EUR 120 million of cargo annually via Suez, the incremental marine war premium runs to approximately INR 80 crore per year. Many marine open policies exclude war risk above a standard sub-limit or have a 7-day cancellation clause under JC3/JC24 wording. Companies that relied on the default open policy found themselves scrambling to place separate war cover at rates 10-12x the prior-year level. Board stress test questions: does our marine open policy have a JC3/JC24 war risk cancellation clause, what is the incremental cost to extend war cover at current market rates, and what is our plan if the Suez disruption recurs at the 2023 intensity.

Trade credit stress tests look at supplier and customer concentration. A pharma intermediate manufacturer with 40% of revenue from three EU customers has concentration risk that most trade credit covers limit through single-buyer or single-country sub-limits of 10-15% of the policy aggregate. If the EU imposes CBAM cost pass-through that causes one of those customers to default or renegotiate contracts, the trade credit cover may pay only the sub-limit, not the full exposure. The stress test quantifies the exposure above the sub-limit and the residual risk.

Taiwan Strait and semiconductor supply chain scenarios affect Indian electronics, automotive, and telecom companies with single-source dependence on Taiwanese foundries. Contingent business interruption cover under property policies typically requires direct supplier damage; a political closure or export ban does not trigger CBI. Political risk insurance (OPIC legacy, MIGA, or commercial carriers like AIG and Zurich Political Risk) can cover this, but the Indian market penetration is low. Board stress test: quantify the 30-day and 90-day revenue impact of a Taiwan foundry shutdown, identify whether any current policy responds, and decide whether to buy political risk cover at approximately 1-3% of the insured amount per year.

India-Pakistan tension scenarios trigger Section 8 war exclusions in most commercial policies. The IRDAI-mandated Terrorism Pool (issued under Terrorism Cover Pool Rules 2002, renewed periodically) provides limited terrorism cover but not war cover. Companies with facilities near the western border, or with cargo moving through affected ports, should model the specific exclusions and the gap they create. The stress test is binary but large: a three-day border closure can cost a large exporter INR 100-300 crore in lost contracts and delayed receivables, most of which is uninsurable under current commercial cover.

Regulatory and underwriting capacity withdrawal is the scenario that caught Indian coal and oil-linked corporates in 2024-2025. It now needs to be a standing part of any board insurance stress test because the pattern is spreading to new sectors.

The mechanism: global reinsurers update their underwriting policies annually, often at their September AGMs or December board meetings, and the updates are implemented at the next treaty renewal (January 1 for most, April 1 for Japan and Korea). An Indian primary insurer gets treaty renewal terms in December for a January 1 renewal, and the underwriting policy change often takes the form of a new exclusion or a sub-limit reduction. The primary insurer then has 60-90 days to communicate the change to corporate clients before the client's policy renewal.

Sectors at elevated risk of capacity withdrawal in 2026-2027: tobacco (several reinsurers have internal working groups), upstream oil and gas (some carriers excluded it in 2024-2025), shale and fracking-related services, single-use plastic manufacturing, and certain agrochemical lines facing regulatory headwinds in Europe. An Indian corporate in any of these sectors should run an annual stress test asking: if our primary insurer loses 30% of its treaty capacity for our risk at the next renewal, what is the pricing and coverage impact.

Worked example: an integrated oil refining company with INR 15,000 crore of property sum insured and INR 3,000 crore of business interruption cover, currently paying INR 75 crore of property premium. Reinsurance treaty capacity reduction of 30% on upstream-related insurers flows through to primary pricing as a 35-55% rate increase. Incremental premium cost INR 26-41 crore. The stress test also asks: if capacity falls below the limit we need, do we have to accept a smaller limit, and if so what is the residual exposure.

Regulatory withdrawal by Indian regulators is a separate but parallel risk. The IRDAI has authority under Section 14(2) of the IRDA Act 1999 to issue directions on specific classes of business. While direct IRDAI withdrawal of capacity from a sector is rare, changes to the File and Use regime, cat-load standardisation circulars, or reinsurance cession rules can materially change primary pricing. The 2024 IRDAI Expert Committee on Reinsurance recommended tighter cession reporting that affected several specialty lines. Boards should ask the broker for an annual regulatory watch list covering IRDAI, SEBI LODR disclosure rules, SEBI ESG disclosure, and the IFSCA, with specific impact quantification for each item.

Systemic cyber is the stress test scenario with the least insurance market maturity and the highest tail risk. Two specific failure modes drive most of the systemic risk: a single cloud provider outage exceeding 72 hours affecting multiple insureds simultaneously, and a widely propagated ransomware or wiper worm causing correlated losses across an industry sector.

Cloud concentration: approximately 65-70% of Indian enterprise cloud workloads run on AWS, Azure, and Google Cloud combined, with AWS being the largest. A 72-hour outage of AWS Mumbai or Hyderabad region would directly affect banks, fintechs, e-commerce players, and IT services firms. Cyber insurance policies pay for business interruption from cyber events, but many policies have waiting periods of 8-12 hours, per-occurrence limits below the likely loss, and systemic event sub-limits that can be as low as 25% of the policy limit. For an IT services firm with INR 200 crore of cyber BI cover, a 72-hour AWS outage producing INR 500 crore of lost revenue may recover only INR 50 crore under the systemic event sub-limit.

Ransomware scenario: a widely propagated ransomware variant (NotPetya 2017, WannaCry 2017) can cause correlated losses across thousands of companies within a 48-72 hour window. Global cyber insurers manage this aggregation through per-event caps, war exclusions (the NotPetya attribution to Russian state actors triggered war exclusion disputes that took four years to litigate), and systemic event sub-limits. Indian cyber insurers writing on reinsurance capacity from Lloyd's and European markets inherit these restrictions. The board stress test question: if our primary ransomware loss is INR 150 crore, what is the coverage if the event is classified as systemic or war-related, and what is the likelihood of coverage dispute.

Cyber stress tests also need to model the non-damage business interruption (NDBI) gap. Traditional property business interruption requires physical damage to trigger; cyber BI under a cyber policy does not require physical damage. Many corporates have cyber policies with BI sub-limits far below their dependence on digital operations. A manufacturing company with INR 3,000 crore of property BI cover may have only INR 100 crore of cyber BI cover, despite the cyber event being the more likely cause of a multi-day shutdown today.

The output of a cyber stress test is usually a grid: row by scenario (ransomware, cloud outage, insider data breach, DDoS, supply chain compromise), column by policy response (cyber policy response, crime policy response, D&O response, property BI response). Cells show expected payout and residual loss. The grid reveals the specific scenarios where the insurance response is thin and informs buying decisions at the next renewal.

The methodology underlying insurance stress testing combines three techniques: probable maximum loss (PML) aggregation, realistic disaster scenarios (RDS), and coverage gap mapping.

PML aggregation starts with single-site PML estimates from catastrophe models (RMS, Verisk AIR, CoreLogic) and extends to multi-site and multi-peril aggregates. For natural perils with defined geographic footprints, sites outside the footprint are uncorrelated with sites inside. The aggregate PML is not the sum of single-site PMLs; it is the expected loss at a specified return period across the portfolio, accounting for correlation. A portfolio of ten sites in Seismic Zone IV has a 1-in-250 earthquake PML approximately 2.5-3.5x the single-site PML; a portfolio of ten sites across Zones II, III, and IV has a 1-in-250 aggregate PML approximately 1.5-2x the single-site PML because only the zone of the epicentre contributes materially.

Realistic disaster scenarios are defined events rather than statistical percentiles. A Lloyd's of London RDS list includes a Mumbai earthquake of magnitude 7.0, a north Indian Ocean cyclone hitting Paradip, and a Delhi flood event on the Yamuna. Each RDS is scripted in detail: location, intensity, duration, affected population and assets. The corporate stress test adopts a subset of these RDS plus bespoke scenarios (a Mumbai monsoon event like 26 July 2005, a Bhopal-style chemical release at a specific facility). For each scenario, the test computes the loss at each facility, aggregates to total loss, identifies which policies respond, and computes the residual loss.

Coverage gap mapping is the systematic comparison of scenarios against policy wordings. A spreadsheet or table lists scenarios in rows and policies in columns; each cell captures the payout formula (which sub-limit applies, which deductible, which waiting period, whether reinstatement is available). The exercise reveals gaps that are invisible in policy summaries. Common gaps: contingent business interruption requires direct supplier damage (so political disruption does not trigger), war and civil unrest exclusions that have been narrowed over renewals without board visibility, cyber war exclusion uncertainty for state-sponsored attacks, and sub-limits on single-buyer trade credit exposure that do not match customer concentration.

Reinstatement limits exhaustion is a specific form of coverage gap. Property policies typically have one or two free reinstatements of the sum insured after a loss, or an annual aggregate limit. After the reinstatements are used, the cover is exhausted for the policy year. A company with two large losses in a single year may find the third loss fully uninsured. The stress test quantifies the probability of hitting the reinstatement limit and the cost of buying automatic reinstatement cover at renewal.

The output of a well-run insurance stress test is a short board document, not a detailed technical report. A one-page summary with five supporting pages is the right format for most audit committees. The structure that works best has seven elements.

Element one: the scenario grid. Five to eight scenarios in rows, policies in columns, payout amount in cells. Each scenario gets a one-line description and a loss estimate. The grid is the visual centrepiece; everything else supports it.

Element two: residual risk summary. For each scenario, the residual uninsured loss is quantified in INR crore. This number is compared to the company's risk tolerance (typically stated as a percentage of EBITDA, market capitalisation, or net worth). A residual loss above 5% of annual EBITDA usually triggers board discussion.

Element three: trigger points for programme restructuring. Specific numeric triggers that would cause the insurance programme to be restructured mid-cycle rather than at the next renewal. Typical triggers: reinsurance treaty capacity for a specific sector falls below threshold, residual cat loss above 10% of EBITDA, three or more scenarios showing residual loss above INR 100 crore, a coverage dispute arising on any scenario that was not previously identified.

Element four: renewal priorities. Based on the stress test, the two or three changes to the insurance programme to pursue at the next renewal. Examples: increase property aggregate sub-limit from INR 600 crore to INR 1,000 crore, add automatic reinstatement cover for nat-cat, purchase systemic cyber cover of INR 100 crore, replace the annual marine open policy with a three-year term to lock in war risk terms.

Element five: a cost-benefit view. For each renewal priority, the incremental premium cost and the incremental cover provided, so the board can weigh the trade-off. A recommendation to increase nat-cat aggregate from INR 600 crore to INR 1,000 crore might cost INR 12 crore of incremental premium and cover a residual loss of INR 120 crore in the compound scenario.

Element six: capital and liquidity buffer check. For any residual uninsured loss, the question is whether the company has the cash and credit facilities to absorb it without breaching debt covenants. A scenario producing INR 150 crore residual loss is manageable for a company with INR 500 crore of net cash; the same loss is existential for a company with INR 20 crore of net cash. The stress test links back to the treasury's liquidity stress test to avoid siloed analysis.

Element seven: governance and escalation. Clear allocation of responsibility: who monitors each trigger, who approves mid-cycle restructuring, how often the full stress test is refreshed (annually with quarterly updates is the common cadence), and what the escalation path is if a scenario materialises. Good governance means the stress test is not a one-off exercise but a living document that informs decisions across the year.