Integrated insurance programmes: limits, layers and overlaps

In short. The problem is usually not that the company has no insurance but that its insurance is fragmented: the policies were bought at different times, with different logic and from different insurers. An integrated programme is a deliberately constructed whole in which cyber, crime and D&O insurance cover different layers of risk, the limits are calibrated to realistic losses, and the definitions and exclusions are consistent with one another.¹

For underwriters and programme managers, the chapter shows how Estonian law treats layered and multi-line structures and where the Estonian rules set limits on what the wording can achieve.

1. Insurance as a mechanism for allocating risk

The purpose of insurance is not to judge the moral rightness of conduct but to allocate risks. Insurance covers the agreed risks even when they materialise through human error, a system failure or a third party's intentional act. This is particularly clear with crime and cyber risks, where the loss often arises from the combination of an employee's mistake and a criminal's malicious conduct.

Estonian law supports this logic on several levels:

• the insurer is as a rule fully released because of the policyholder's fault only in the case of intent; release for gross negligence can be agreed, but the consequences of breaching a duty of care are limited by law (Law of Obligations Act (võlaõigusseadus, VÕS) § 452);²
• in liability insurance, the insurer is not liable if the policyholder caused the loss intentionally and unlawfully (VÕS § 513); the Supreme Court has treated the absence of cover for intentional acts as a general principle of insurance in a case on the compulsory liability insurance of a bankruptcy trustee, where the applicable term excluded the trustee's own intentional breach;³ in crime insurance, however, intentional fraud by an employee or a third party is often precisely the insured risk, so the policy must be examined separately to establish whose intentional conduct is covered and whose is excluded;
• in the event of a breach of a duty of care, the insurer can be released or reduce the indemnity only to the extent that the breach affected the occurrence of the insured event or the extent of the loss.⁴

The conclusion for the insurance programme: exclusions must not make the cover illusory. If a policy contains an exclusion so broad that an ordinary fraud scenario falls outside the cover, the policy is not suitable for that risk, even if the exclusion could be interpreted narrowly in a dispute.

2. Primary and excess layers

For large risks, cover is often divided into layers. International insurers and the Lloyd's market use this structure widely; in the Estonian market, a layered structure is found mainly in large and international programmes.

• The primary layer is the base cover: its insurer pays first, up to its limit. This layer is the most likely to respond, so its insurer's risk is greater. The primary layer may also be shared between several insurers (quota share).
• The excess layer responds only once the primary layer has been exhausted. If the primary layer covers up to EUR 1 million and the excess layer from EUR 1 million to EUR 5 million, then for a loss of EUR 3 million the primary layer covers EUR 1 million and the excess layer EUR 2 million.

Legal nature. Estonian law does not regulate layered structures separately. VÕS § 484 deals with co-insurance, where several insurers insure the same risk under one contract and are liable for their own share from the outset (proportional allocation).⁵ A layered structure works differently: the insurers' liability is successive (vertical allocation), and the excess insurer's obligation becomes due only once the sum insured of the underlying layer has been exhausted. A layered structure must also be distinguished from reinsurance, where the risk is distributed between insurers but the policyholder has no direct legal relationship with the reinsurer.

The practical questions of a layered programme are the following.

1. Attachment point: the exact amount from which the liability of the excess layer arises.
2. Follow form or stand-alone excess: a follow-form excess layer repeats the terms of the primary policy; a stand-alone excess layer has its own terms. If the terms differ, the primary layer may cover a loss that the excess layer does not.
3. Exhaustion: whether the primary layer is deemed exhausted only through the insurer's actual payments or also through loss borne by the policyholder itself. If the primary insurer settles with the policyholder below its limit, the excess insurer may argue that its layer has not been reached.
4. Drop-down: whether the excess insurer must step into the place of the primary layer if the primary insurer is insolvent or justifiably refuses to pay. Without an express agreement, as a rule it need not.

3. Per-claim limit and aggregate limit

In international policies, the word "limit" is often used to denote the sum insured. Two concepts must be distinguished.

• Per-claim limit (per claim or each loss limit): the maximum indemnity for a single insured event.
• Aggregate limit: the maximum total indemnity for the whole insurance period.

If the per-claim limit is EUR 1 million and the aggregate limit EUR 2 million, and two losses of EUR 1 million each occur during the period, the aggregate limit is exhausted. For a third loss of the same size there is no longer any cover, even though the per-claim limit has not been exceeded. This is particularly important for risks that materialise repeatedly: several separate social engineering frauds, claims by many persons following a data breach, several D&O actions.

Equally important is the aggregation clause (aggregation, related claims, single loss). If the policy treats losses arising from the same activity or from the same person as one event, one per-claim limit and one deductible apply. In long-running embezzlement by an employee, this may be favourable to the policyholder (one deductible) or unfavourable (one limit), depending on the amounts.

In Estonian case law, a tiered sum insured in standard terms has been held permissible if it is understandable to a reasonable policyholder and does not unreasonably harm the policyholder; an individual agreement on a single sum insured, however, prevails over the standard term.⁶

Defence costs within or outside the limit

In liability and D&O insurance it matters whether defence costs are included within the limit (costs inclusive) or are payable in addition to it. Under Estonian law, liability insurance also covers the legal costs that the policyholder could consider necessary to protect its rights and, under certain conditions, the costs of criminal and administrative proceedings (VÕS § 510, § 511 lg 1–2). § 511 is not, however, a semi-mandatory provision, so the policy may regulate the cover of defence costs differently.⁷ If the policy provides that defence costs reduce the limit, lengthy proceedings can exhaust a large part of the limit before the amount of the damages claim is known.

4. Sub-limits and deductibles

A sub-limit caps the indemnity for a specific category of risk below the main limit. Typical sub-limits apply to social engineering fraud, client property, ransom, PCI fines and fees, regulatory fines and supply-chain interruption. A sub-limit is always part of the main limit, not an additional amount, unless the policy says otherwise.

A deductible (deductible, retention) may be a monetary amount, a percentage, a time-based deductible (a business interruption waiting period, for example 8 to 12 hours) or a combination of these. In D&O insurance, the deductible usually applies only to the company reimbursement cover (Side B), not to the executives' personal cover.

The risk retention decision. The level of the deductible is not only a question of price. It must match the company's liquidity: if the deductible is greater than the amount the company can bear quickly in a crisis, the insurance will not work when it is needed most.

5. How the three lines work together

A single incident can trigger all three layers. For example, the takeover of an e-mail account leads to a fraudulent payment, which is followed by a data breach and, finally, a claim against the board. In such a situation the programme must work as a whole. For more detail, see cyber, crime and D&O insurance: interplay and boundaries.

6. Coverage gaps and overlaps

A coverage gap is a situation in which the loss falls under none of the policies. It often arises when a risk falls between two lines: the cyber policy excludes a payment entered by an employee, and the crime policy does not cover the social engineering scheme or covers it with a negligible sub-limit.

An overlap is a situation in which the same risk could fall under several policies. An overlap is not a problem in itself if it is managed deliberately; a certain overlap may even be advisable in order to avoid gaps. The problem arises when the policies contain mutually referring exclusions or other insurance clauses. Under Estonian law, in the case of multiple insurance, the insurers are jointly and severally liable to the policyholder (VÕS § 486), but this does not resolve a situation in which each policy asserts that the loss is not its insured event.⁸

7. "The wrong clause in the wrong place"

One of the most underestimated problems is a situation in which the necessary cover exists but sits under the wrong policy, or is worded so that it does not cover the actual risk. For example:

• the computer fraud cover is in the cyber policy, but the social engineering scheme is defined so narrowly that a payment approved by an employee falls outside it; the crime policy contains the same extension, but with a sub-limit of EUR 25,000;
• the D&O policy covers the board's liability but excludes certain regulatory proceedings and fines; supervisory proceedings following a cyber incident remain unprotected;
• the business interruption cover is in the property policy but requires physical damage; an IT outage without physical damage does not qualify.

The solution is to build the programme on the basis of risks, not policies. For each risk scenario, ask which policy covers it and whether the cover is adequate, and then check the consistency of the policies with one another.

8. Summary: the features of a good programme

A well-functioning integrated programme:

• is based on a documented risk map;
• avoids coverage gaps and manages overlaps deliberately;
• places each significant risk in the right policy with the right wording;
• calibrates the limits, sub-limits and deductibles to a realistic worst-case scenario;
• contains a harmonised war exclusion and notification procedure in all policies;
• is reviewed at least once a year and after every significant change.

A model structure is set out on the page Näidis-kindlustusprogrammi struktuur (in Estonian).

Related pages

• Ettevõtte kindlustusprogramm (a company's insurance programme, in Estonian)
• Avoiding coverage gaps
• Estonian Supreme Court: insurable value and indemnity
• D&O claims in Estonia
• Under-insurance, over-insurance and double insurance in Estonia

References