The second storm of the autumn is on the forecast track and the chief risk officer asks the question she asked in September: how much catastrophe cover is left? The honest answer on most desks is “let me check”, followed by an hour with the cession spreadsheet, because the figure depends on what has been paid, what is still reserved, how many reinstatements have been used and whether anyone has netted the last recovery.
The question is simple and the arithmetic is not hard. What makes it slow is that the inputs live in different places and nobody trusts the total. This post is about how InsightCede keeps that total, what the exhaustion watch agent does with it, and where its warning comes too late.
What a layer has left
A layer’s lifetime capacity is its limit, plus its limit again for every reinstatement the contract grants, never more than an aggregate limit if it has one. A $10 million layer with one reinstatement can pay $20 million in the treaty year. What it has used is everything ceded to it, paid and outstanding, net of every movement since — derived from the cession ledger each time, not typed into a field that can drift.
The engine enforces the result. A layer cannot pay more than it has: when a loss wants more than the capacity left, the engine cedes what remains and writes the rest on the cession as uncovered, with the reason in words. The retained loss is visible as retained loss instead of being silently absorbed, and at that moment the engine notifies the ceded desk, the managers and the CRO, as a critical notification, with the amount retained.
That notification is the alarm after the fact. The exhaustion watch is meant to be the warning before it.
The watch
Every six hours the exhaustion watch agent reads every layer of every active treaty. A layer eroded to 60% or more of its lifetime capacity — the carrier can move the line — gets a record: what is left, the reinstatements used, the claims that eroded it with their amounts, and three scenarios sized from the layer’s own limit. A loss to the layer of half its limit, a full limit and twice its limit: for each, what the layer would still pay and what would fall back to the carrier. If what is left is less than one limit, the record proposes considering a back-up layer or a reinstatement purchase; otherwise it proposes to keep watching.
It is an alert at L1, Draft, on the exhaustion_review checkpoint. It sends
nothing to anyone outside; it waits in the queue for the people who buy the programme. Unchanged,
it is not repeated every six hours: a scheduled agent keeps the open record until the facts move,
and a new one supersedes it when they do.
flowchart LR
A["Loss cessions
paid and outstanding"] --> B["Layer erosion
derived from the ledger"]
B --> C{"Every 6 hours
eroded 60% or more?"}
C -- no --> X["Nothing prepared"]
C -- yes --> D["Alert at L1
left, claims, 3 scenarios"]
D --> E["Head of RI and CRO
back-up cover or watch"]
B --> F{"A loss wants more
than is left?"}
F -- yes --> G["Remainder written
as uncovered"]
G --> H["Critical notice to
desk, managers, CRO"]
On the demo programme, the warning never had a window
The demo ledger has a layer that did exactly what this post is about. VSURE-PROP-CAT 2025 layer 1 is $15 million excess of $5 million with one reinstatement, so $30 million of lifetime capacity. Three catastrophe claims reached it.
xychart-beta
title "Layer 1 lifetime capacity used, %"
x-axis ["WIND-01", "HAIL-02", "FREEZE-03"]
y-axis "% used" 0 --> 100
bar [50, 100, 100]
The windstorm took the layer to 50% — below the 60% line, so no alert. The hailstorm took it from 50% to 100% in one claim. There was never a moment at which a 60% watch could have warned before the layer was gone. The freeze in December then ceded nothing to layer 1: its $13 million to the layer is written on the cession as uncovered, “layer exhausted: 15,000,000 limit with 1 reinstatement(s) gives 30,000,000 of lifetime capacity, all of it used”, and the demo position shows $13,000,000 of uncovered, retained loss.
The alert in the demo queue reads “VSURE-PROP-CAT 2025 Layer 1 exhausted: no further cession available”. Its evidence is exact: $30,000,000 of $30,000,000, one reinstatement used of one, the two claims at $15,000,000 each, and all three scenarios fully uncovered. Its explanation, written by the model, calls the $30 million the layer’s “limit”. It is the lifetime capacity; the limit is $15 million. The evidence is why that slip is harmless, and why it is the part to read first.
The use case, in one table
| A layer near exhaustion | |
|---|---|
| Trigger | Scheduled, every six hours: a layer of an active treaty eroded to the watch line (60% of lifetime capacity by default) or beyond |
| Actor(s) | The head of reinsurance; the CRO; the CFO for the net position |
| Agent | Exhaustion watch agent (the engine itself raises the notice when loss is actually left uncovered) |
| Grounded in | The layer’s limit, reinstatements, reinstatements used and erosion; the loss cessions on the layer by claim |
| Prepares | An exhaustion alert: what is left, the claims that eroded it, three scenarios with what each would leave uncovered, and a proposed step |
| Checkpoint & default level | exhaustion_review · L1 Draft |
| What a person decides | Whether to buy back-up cover or a reinstatement, or keep watching; the threshold the watch runs at |
| What is recorded | The alert as a decision record with its evidence and scenarios; the answer as feedback; on the ledger, any uncovered amount on the cession with its reason |
Where retained loss is counted
The uncovered amount is not a note in a report. It is a column on the loss cession, with its reason, and it is summed wherever the net is shown: the Cessions screen carries an Uncovered and retained tile and an Uncovered only filter, the Position screen opens with an alert when any ceded loss had no cover behind it, and the CRO’s notification links to the cession that was retained.
Why the scenarios are sized from the limit
The agent could ask a model what the next storm might cost. It does not, because nothing in the ledger supports an answer, and an invented loss in a risk record is worse than none. Half, one and two limits are not a forecast; they are a ruler laid against what is left, so the CRO can put her own view of the next event against it.
What it does not do
- It cannot warn about a jump. A watch that runs every six hours at a 60% line says nothing when one claim takes a layer from below the line to exhausted, as on the demo layer. For cat layers that one event can fill, a lower line is worth setting.
- Scenarios are losses to the layer, not ground-up. “A full-limit loss” means $10 million reaching this layer. The scenarios do not model the retention, the layer above or other treaties; the record counts the layers above and leaves them to the reader.
- It is not a catastrophe model. No exposure, no return periods, no event sets. Cede does not receive exposure data, and the agent never invents a scenario loss.
- It does not buy cover. The proposal is a step to consider. Back-up cover is placed by people, and the new layer enters the programme like any other treaty.
- The words are the model’s; the figures are not. As the demo shows, an explanation can misname a figure. The evidence beside it cannot.
If the answer to “how much cat cover is left?” takes an hour on your desk, bring your layers and this year’s cat claims and we will show you the figure, the scenarios and where the line should sit.