Ep. 38: Winning Insurance with Strong Resilience

Full transcript

Bobbie Ramsden-Knowles: Hello, everyone, and welcome to Emerge Stronger Through Disruption podcast series. I’m Bobbie Ramsden-Knowles, co-leader of PwC's Global Center for Crisis and Resilience, or GCCR for short, and I’m coming to you from our offices in the UK today. So the aim of this podcast series is to explore the challenges facing businesses in this environment of constant crisis and change, and to discuss how successful business leaders can emerge stronger through this disruption. Before we dive into today's conversation, if you’re enjoying the Emerge Stronger Through Disruption podcast series, please subscribe wherever you get your podcasts and consider leaving a like or a comment.

Hearing from you helps us know that we’re connecting, and it also helps more people discover the show. We really, really appreciate your support. So today, we’re discussing the link between resilience and insurance and the opportunity to directly use your resilience investment to benefit your insurance purchase or renewal.

And joining me to explore this topic is Martin Murphy, PwC UK Corporate Insurance Strategy Co-leader, and he focuses on helping organisations with all aspects of insurance procurement. Welcome, Martin.

Martin Murphy: Thanks, Bobbie. I’m really excited to be here.

Bobbie Ramsden-Knowles: Right, Martin. Now, I love the topic we’re discussing today because actually many organisations I work with aren’t really fully connecting the investment they’ve made at building resilience to how it can benefit them from an insurance perspective, and it's a huge opportunity.

Would you agree?

Martin Murphy: Yeah. I couldn’t agree more, Bobbie. I think lots of organisations invest in strong resilience and then kind of stop, and I think by doing that, they’re failing to convert that investment into insurance value, whereas if they did, they could be saving money and further mitigating risk.

Bobbie Ramsden-Knowles: Well, I’m sure everybody listening really wants to understand how they can actually do that.

Now, how should organisations be thinking about this link between resilience and insurance then?

Martin Murphy: So I think some resilience teams work hand-in-hand really closely with their insurance function, and I think they see insurance as a core part of the risk and the resilience jigsaw, but unfortunately, others don't.

So many organisations spend millions on cybersecurity, on operational resilience, on business continuity, on crisis management and risk management. Then they renew their insurance programme, probably also spending millions, and they’re wondering why the premiums aren’t moving. And I think there’s context to this that, you know, as well as being a big spend and a big cost item, insurance can be a really important part in that overall operational resilience of an organisation.

It can provide that additional stability and security and can represent a bedrock which allows organisations to be taking risks, innovating, growing, and providing consistent and high-quality services. So I think good practice in this space, Bobbie, is to identify and then coherently communicate all recent investments in organisational resilience to your insurance broker and your key insurers.

So really tell that story on resilience. I think it’s often a really great and a really compelling story, and I think insurers will view each organisation as a risk within their risk portfolio. And the better risk you appear relative to competitors and peers, the more likely you are to be able to source insurance coverage for different risks.

That’s three things. So firstly, the best value from a cost perspective. Secondly, tailored to your risk profile. And thirdly, you know, high-quality coverage that pays out in the event of a claim

Bobbie Ramsden-Knowles: Now that point you said about organisations need to tell the story on resilience, that for me really resonates, particularly given the external environment organisations are operating in right now.

It’s hugely relevant, right?

Martin Murphy: Yeah. That’s right, Bobbie. I think we’re in a what we call a softening insurance market right now, which basically means there’s more competition among insurance companies and therefore better affordability and better accessibility for buyers of insurance. So in a soft market, insurers are more able and more willing to concede ground, both from a price and a coverage perspective, as long as you’re a good and a well-portrayed risk.

And I think, Bobbie, getting this right isn’t necessarily creating new work. It’s more packaging up work that’s already been performed or is already in progress for a different audience, the insurance market.

Bobbie Ramsden-Knowles: That’s a brilliant, well-made point, Martin. I wonder if we now go back to the opportunity areas that you highlighted.

Could you go a bit deeper on each of those perhaps?

Martin Murphy: Yeah, sure. So I think there’s, at a high level, three benefits to organisations that bring their resilience strength into those insurance negotiations. The first one’s cost, and this one’s quite simple really. Better and well-articulated risks will attract more insurer competition, and that greater competition will drive better pricing.

So if you can consistently demonstrate strong resilience, it can really reduce premiums. So for example, two organisations may have the same revenue, but one has much stronger resilience evidence and a better story and therefore secures materially better pricing for similar coverage. The second area is around coverage that’s better tailored to an organisation’s risk profile.

So for example, this could be adding coverage for the organisation’s key exposures, and that could be wider cyber coverage. It could be cyber policies adapted for the OT or the manufacturing environments. It could mean actually removing unnecessary coverages that provide little value or removing restrictive exclusions or endorsements in policies.

It could mean tailoring policy wording to reflect operational realities better. There’s also an aspect here of scenario-based limit setting where actually strong resilience programmes often involve scenario exercises and stress testing, and the outputs of those exercises can be used to inform or even determine insurance limits to identify protection gaps and to help justify investment decisions.

I think another aspect is risk appetite and risk retention strategy. Resilience and risk appetite are closely linked, and some of the key questions on appetite often include things like what disruption can we absorb, what kind of losses can we tolerate, and what therefore risks should we be transferring.

And when it comes to the insurance programme, that can really influence the size of retentions and deductibles in policies. It can influence levels of self-insurance or the use of captives or other risk retention vehicles, as well as the overall programme structure. So I think it’s fair to say the strong resilience probably doesn’t just affect price.

It can affect what insurers are actually willing to cover. And the third and final area is the quality of coverage. So I think it’s fair to say not all insurance policies are equal, and they’ll provide different levels of things like claims payment certainty, the strength of the underlying insurer, coverage wording quality, claim service, and incident response support.

So better risks will often be getting broader and higher quality wording, getting better insurance engagement, and also a greater willingness to negotiate in policies.

Bobbie Ramsden-Knowles: That’s really helpful, Martin. So there’s clearly strong reasons to bring your resilience investment into insurance discussions. Perhaps you could talk a little bit about what insurers want to see and hear in these discussions.

Martin Murphy: Yeah, of course. So I think it’s best to tailor the way you talk to insurers and the insurance market and to frame it in a conversation and a language they understand. So for example, you know, insurers are in the business of almost buying future risk. They’re comparing organisations against peers. They probably care less about things like policies and frameworks and more about hard evidence, so they want that proof that losses are less likely and less severe.

And I think because of those drivers, they really love seeing information on things like cyber maturity, on crisis response capability, operation resilience testing, business continuity exercises, supply chain mapping, incident and claims performance as well is really key. So basically, insurers love evidence, Bobbie, and I think rather than hearing simply, "We have strong resilience," they wanna see test results and audit outcomes, hard recovery times, incidents and claims reductions, cyber maturity scores, and then kind of risk engineering reports.

That’s the kind of thing that can move insurance underwriting decisions in a more positive direction. And I think it’s also worth keeping in mind that different insurers will value different things, so it’s best to try to tailor that resilience story to the audience in question. So for example, a property insurer’s likely more interested in engineering, in maintenance, and in fire protection.

A cyber insurer will care more about things like multi-factor authentication, backups, and incident response. And a liability insurer will be more focused on things like governance, training, and kind of incident and claims trends.

Bobbie Ramsden-Knowles: Thanks, Myles. And I think your comments really show the value of sharing your resilience strengths with insurers.

But from my experience, I think a lot of organisations could probably do better at building that linkage. Would you agree?

Martin Murphy: Yeah, I think totally, Bobbie. I think some do it really well, but we do see some quite common mistakes across a lot of organisations, such as only talking to your insurers at the point of the annual insurance renewal and not in between.

We see some organisations just filling in their insurer proposal forms and then stopping, and I think by doing that, they’re missing the opportunity to tell that resilience story and get in front of insurers in person to bring it to life. I think some firms will provide huge volumes of information to insurers but with no real narrative, and that can be really challenging for insurers to understand and do anything with.

We see some talking about kind of activities rather than outcomes. So instead of saying, "We ran 25 or 30 workshops," actually saying instead, "Incident response times reduced by 40%," that was the output. And finally, I think we sometimes see insurance teams and resilience teams not being close, unfortunately, and- that’s surprisingly common, despite the kind of obvious overlaps.

Bobbie Ramsden-Knowles: Okay. So we’ve talked through the benefits of bringing resilience investments into insurer discussions, and that it’s not so much new work, it’s about bringing the right tailored story and evidence to that conversation. But is there a flip side to that linkage?

Can insurance benefit resilience efforts?

Martin Murphy: Definitely, Bobbie. I think insurance, when it’s done correctly, can be a really great strategic tool and a resilience driver itself. So for instance, you know, insurance can act as a real trigger for discussing and deciding upon key aspects of risk appetite, landing on that question of how much risk do we actually want to retain versus transfer via insurance.

Areas like monitoring and reporting on trends in claims and incidents can drive real, tangible improvements in risk behaviors across an organisation when it’s done well. And I think having clarity on the size of the risks being retained by organisation, whether it’s through self-insurance, whether it’s through an insurance captive, can really help to focus minds on the importance of managing risks well, ’cause your own balance sheet is on the line there.

And I think the renewal process itself, it can be long, can be draining, but actually it can helpfully shine a bit of a light on some of those key exposures across an organisation. So to take cyber as an example again, you know, cyber insurers need by nature to be at the forefront of understanding cyber risk because they're taking on such a large portfolio of cyber risk.

So I think therefore, cyber insurance proposal forms need to be really dynamic, and they can be used by organisations and insurance buyers to provide a bit of guidance on the very latest areas to develop controls and leading practices. And I think more broadly, insurance helps, Bobbie, to mitigate and transfer some of those major risks of doing business.

So by proactively linking insurance with risk management, it enables that holistic treatment of key exposures. So I think overall, if insurance, you know, shouldn’t just be viewed as a, a risk transfer product, it can be both a beneficiary of resilience, as we talked about quite a lot today, but also a driver of resilience as well.

So I think organisations that connect those two worlds tend to achieve better outcomes in both.

Bobbie Ramsden-Knowles: That’s a really helpful summary, Martin. So for those listeners who either don’t bring resilience into their insurance discussions or feel that they could do it better, what are the things that those organisations should do tomorrow?

Martin Murphy: Yeah. So I think, you know, rethinking what they’re taking to their next insurance renewal discussion, whether that’s with their broker, whether it’s with their key insurers, and really spending time honing that story on resilience and how it has been invested in and how it has been prioritised can be really powerful.

So, you know, looking at some of the following categories. So things like, you know, what have been the major resilience investments in recent months? What are the quantified resilience outcomes? You know, how much has incident frequency reduced? What's been the reduction in downtime? Have there been improved recovery times or improved cyber maturity scores or audit outcomes?

I think looking at key control improvements can be strong as well, as well as the incident response capability and the business continuity and recovery capability aspects. I think third-party and supply chain resilience is increasingly important for insurers too. So demonstrating that supplier oversight and concentration risk management can be key.

And I think last but not least, simply the lessons learned and the actions taken. So not just we’ve had X and Y incidents, but actually we’ve had these incidents, we’ve learned from it, and we’ve implemented these three risk improvements.

Bobbie Ramsden-Knowles: Thank you, Martin. That was really hugely insightful. A great discussion.

So with that, I think that’s a really great place to wrap up for today. So to our listeners, thank you so much for tuning in. In upcoming episodes of Emerge Stronger Through Disruption, we’re gonna continue to tackle the topics that keep business leaders up at night. And as always, we’d really love to hear ideas from listeners about the area as well as topics you’d like us to address.

So please get in touch with Martin and me via LinkedIn. And in the meantime, remember to subscribe to Emerge Stronger wherever you get your podcasts. Until next time, stay resilient and prepared for whatever challenges come your way.

© 2026 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.