Is a Peril Hierarchy Enough?

Structure, semantics and inter-layer cost of perils for the CBAA modules

Version 0.2, draft for review. Companion to the reference peril vocabulary, the asset exposure ontology, term parameters and the MORK bridge, which implement its recommendations. Cites Open CBAA’s design specification (AP, DP, D) and LATTICE integration specification (I, L), and LATTICE ADRs by number. Where this sketch and the applied insurance reference epic or its ADRs (A-98 to A-102) differ, they take precedence.

Summary

A hierarchy of perils is necessary and not sufficient. It is the right backbone for the most frequent CBAA question, “is this risk inside the perils the Coverholder may bind?”, and LATTICE’s hierarchical match with exclusions already answers that question for single-valued cases. It is not sufficient because the CBAA drafts, their reference lists and the London and US markets they sit in use “peril” for several different things at once, and because the meaning of a peril in a contract is partly fixed by the wording, the governing law and the location, not by the peril.

Eight further notions carry that meaning. Four belong in the vocabulary as SKOS-compatible structure: characteristics, collections, typed causal and overlap relations, and definition bases with links to Quantification. Four belong elsewhere and must not be forced into the vocabulary: contract-relative classification and definition (Open CBAA statements), causation rules (evaluation profiles by governing law), peril-by-location conditions (exposure units), and occurrence grouping (contract terms, with informative defaults). Three upstream changes to Eligibility serve the rest: reading a set of values (the risk’s several perils, a loss’s mechanisms), leaving undecided what a flat list cannot decide, and matching over kind links only. The first two are in LATTICE’s plan (ADR-A103, ADR-A100). The third does not block a first release.

The rich structure belongs to LATTICE’s applied insurance reference, not to Open CBAA. CBAA perils are defined by each agreement’s drafter or by the market, and arrive as flat lists or simple taxonomies far more often than as structured schemes. Open CBAA therefore binds the operative scheme it is given, checks at the level of structure that scheme has, and reaches the reference’s structure only through reviewed MORK crosswalks. Compilation of any of this into generated forms is optional and never the source of truth.

1. The Question

The integration specification leaves perils out of design-time classes because a risk has several (D24, I7), and the design specification’s catalogue lists peril as a hierarchical, runtime-critical dimension bound to a market edition (design-spec §4.5). Both treat the peril as one hierarchical dimension. This paper asks whether that is enough for the modules to operate, what else is needed, where each extra notion should live, and what each costs across Open CBAA’s modules and LATTICE’s layers.

“Enough” is judged against four evaluation modes (design-spec §6.3):

and three design-time checks: materiality of an amendment that changes perils, overlap between segments, and completeness of the exposure data a peril needs.

2. What the CBAA Drafts Ask

The drafts reviewed are M1 to M14 and the M5 base tables. Every peril use found is listed.

Two observations follow. First, the drafts use perils to segment authority (U1, U2, U10), so a peril scope names perils at whatever level a segment needs, and every level must be matchable. Second, the drafts attach other structure to perils: standard sets (U4), defined terms (U5), pools (U6), bundles and open grants (U7), territory-conditioned obligations (U8) and event grouping (U9). None of these is a parent-child relation.

3. What the Evidence Shows

3.1 The reference list mixes axes

The M5 “Perils List” (U3) is the list a CBAA drafter picks from. A sample of its 525 entries, grouped by what each entry actually names:

The heading itself says the list is two things (“cause of loss, subclass of business”). A hierarchy cannot be built over it without deciding, entry by entry, which axis the entry lives on, and many entries live on two (arson is a human act and a fire mechanism, “accident railway crossing” is a transport accident in a context). The reference vocabulary therefore does not adopt the list. It decomposes each code into a cause and characteristic values by a MORK mapping (peril vocabulary §9.2), so the list stays usable as input and never shapes the hierarchy.

3.2 A standard set that is not all perils

U4 excludes, by default, war (a conflict cause), nuclear, chemical, biological and radiological perils (a mix of accidental and deliberate causes, grouped by mechanism), and financial guarantee, default and insolvency risks. The last group is partly a cause (default, insolvency) and partly a class of business (financial guarantee), which the CBAA’s own insurable interest hierarchy lists under “Events and Intangibles, Contracts”. Represented as one node, the set would need a parent that means nothing. Represented as a collection spanning families and dimensions, it is exact, and “removal marks the table non-standard” becomes a comparison between a segment’s exclusions and the collection.

3.3 Model groupings cross branches and duplicate phenomena

Open catastrophe model codes group wind perils (tropical cyclone, extratropical cyclone, storm surge, hail, tornado, straight-line wind) and flood perils (fluvial, pluvial, coastal and surge) under group codes, including a “wind with surge” group. Storm surge appears on both sides, once as a wind sub-peril and once as coastal flood. Model outputs follow those groupings: one portfolio reports “hurricane, wind and surge combined”, “surge only” and “inland flood, non-surge” as three metrics. Any tree must put surge on one side, and every consumer that thinks of the other side then gets it wrong. Collections and overlap links carry the groupings without choosing.

3.4 Some perils exist by designation, some by threshold

A named windstorm is a storm a meteorological authority has named. Its extension is defined by an administrative act, not by physics, and it overlaps tropical cyclones and, in some regions, extratropical storms, without being a kind of either. A hurricane is a tropical cyclone above a sustained-wind threshold in particular basins. Some wordings define “storm” by a wind speed. “Cyber event” and “critical illness” are whatever the wording defines. A hierarchy records only that one class sits inside another. It cannot record what the membership test is, so a threshold-defined peril cannot be checked against an intensity, and a designation-defined one cannot be distinguished from a meteorological class with the same name.

3.5 Storm surge is classified by the wording

In the US worked example, the primary form’s water exclusion removes surge outside a named windstorm, and surge is covered only as part of named windstorm, with a percentage-of-value deductible. A 30 million surge loss at a 285 million location is a 14.25 million deductible as windstorm, or a 10 million sub-limit as flood. In the London example, flood sub-limits follow the model’s flood grouping. The same physical event is wind in one contract and water in the next. This is the clearest case against encoding classification in the vocabulary: the vocabulary should say surge is part of a cyclone event (a kind link would be wrong) and overlaps coastal flood, and the wording’s classification statement should decide.

3.6 Some peril scopes depend on where the risk is, not on the peril

The US example sub-limits flood differently inside and outside special flood hazard areas, and the lender covenant requires flood cover for properties in those areas and named windstorm cover for properties above a value. The London example sub-limits a territory. CBAA U8 obliges natural catastrophe cover in one country when fire cover is given. “Flood in a special flood hazard area” is not a narrower peril. It is a peril condition conjoined with a location condition (a regulatory zone designation), and the case the conjunction is evaluated on is a location and peril pair, not a policy.

3.7 One word on three axes

“Equipment breakdown” names a cause (mechanical or electrical failure), a coverage section (the London excess layers exclude “boiler and machinery”, the US programme covers it by a separate form) and a class of asset (boilers, pressure vessels, machinery). “Business interruption” is named as a peril in some models of cover, but it is a consequence of a cause. “Cargo” and “motor” name subjects and lines of business. A single hierarchy puts all three kinds of term in one tree, so an exclusion of the section would also exclude the cause wherever it occurs.

3.8 Causation differs between London and US

A loss often has more than one cause: a cyclone causes surge, a cyber attack causes a fire, a freeze causes a pipe to burst. Which cause governs cover is a question of law.

This is general background for design, to be confirmed by counsel before any rule is encoded. The design consequence does not depend on the detail: the rule that picks the governing cause is set by governing law and wording, so it is an evaluation profile selected per contract, and a loss record must keep the chain of causes, not one code.

3.9 Cyber is split by intent and written back by mechanism

The London layers use two cyber clauses: one excludes malicious cyber acts and writes back non-malicious events that cause physical damage, the other excludes all cyber absolutely. The write-back scope is a closed list of physical damage mechanisms (fire, explosion). The US primary has an absolute cyber physical damage exclusion. To evaluate these, a loss needs its agency (malicious or not) and its mechanism (what did the physical damage), and the vocabulary needs both as characteristics. A tree of “cyber” concepts alone cannot express “non-malicious and resulting in fire”.

3.10 Named-peril bundles are sets

CBAA U7 names “the lesser perils of fire, extended coverage, vandalism and malicious mischief”. US causes-of-loss forms come in named-peril variants (a basic list and a broad list) and an open variant with exclusions. Bundles are sets of perils from several families, varying by market and form edition. They are collections, never nodes, and the open variant is not a bundle at all but “everything in the edition, minus exclusions”.

3.11 Occurrences are grouped by peril

Hours clauses group losses into one occurrence within a window that depends on the peril, and the US example applies a 72-hour windstorm deductible per location. U9’s “any one catastrophe” and “any one event” bases, and the US named storm aggregate that decides when a higher layer attaches, both depend on grouping losses into events. The window is a contract term, but its customary values differ by peril, and an event record needs the peril to know which window to apply.

3.12 Pools and residual markets are linked to perils and places

CBAA U6 lists terrorism and flood pools. The US example uses state residual wind pools and a national flood scheme that sits primary to the programme. Each pool covers a peril set in a territory. They are neither perils nor territories, and their link to both is structure the vocabulary should carry (peril vocabulary §9.4).

4. Where a Hierarchy Alone Fails

F1 to F5 are vocabulary structure. F6 to F8 are not, and fixing them in the vocabulary would make it worse.

5. Structural Notions

Each notion: what it is, why CBAA needs it, the ways it could be expressed, and the choice.

6. Where Each Notion Lives

flowchart LR
    subgraph Vocab["Reference peril vocabulary (LATTICE applied insurance)"]
        N1["N1 kind and part"] --- N2["N2 characteristics"] --- N3["N3 collections"]
        N4["N4 triggers"] --- N5["N5 overlaps"] --- N6["N6 definition basis"]
        N11["N11 pools"] --- N13["N13 editions, crosswalks"]
    end
    subgraph Stm["Open CBAA statements and agreements"]
        N9["N9 definitions, classifications"] --- N10["N10 causation profiles"] --- N7["N7 occurrence grouping terms"]
        OP["operative scheme: drafter or market"]
    end
    subgraph Tp["Term parameters"]
        N15["N15 party roles, liability direction"]
    end
    subgraph Aeo["Asset exposure ontology"]
        N8["N8 exposure units, zones"] --- LR["loss cause chains"]
    end
    subgraph Lattice["LATTICE substrate"]
        E["Eligibility: hierarchical match, exclusions"] --- Q["Quantification: thresholds, windows"]
        N16["N16 flat lists and missing evidence: Undetermined"] --- E
        B["Behaviour: advisory triggers (N14)"] --- S["Surface: generated classes"]
        M["MORK: decomposition mappings"] --- V["Vocabulary: editions, scoped bindings"]
    end
    Vocab --> V
    N6 --> Q
    N9 --> E
    N8 --> E
    N13 --> M
    OP -- "reviewed crosswalk" --> M
    OP -- "evaluated" --> N16
    N15 --> P["Party: roles, occupancies"]

Three properties, one contract. The CBAA uses three different peril relations, and today Open CBAA has one property (rsk:peril):

All three name the same scheme contract, so one binding serves them, and none is mistaken for another.

7. Inter-Layer Dependencies and Cost

7.1 By notion

7.2 Upstream changes

Each substrate change follows the clean-room procedure (ADR-A-C2): a domain-neutral premise and two non-insurance examples before any mechanism prose. The premises exist without insurance: kind against part-of matching (anatomy, organisational units), set readings (a patient’s several diagnoses, an applicant’s several qualifications), episode grouping (clinical episodes of care, incident grouping in operations), hierarchical match over a flat list (a lender’s sector codes against an industry classification, an employer’s job titles against an occupational classification).

7.3 The cost of not doing it

7.4 Optional compilation

Every check runs directly over the source graph (route R1, term parameters §5). Surface projections, generated classes and capacity runtime profiles are allowed where profiling shows a need, as cached reproducible artefacts with parity tests against R1. There is no synchronisation back from a compiled form to its source. The cost of compilation is therefore opt-in per deployment, and its absence costs latency, not correctness.

8. London and US: What the Differences Change

A CBAA binder is written in London, but its risks may be US risks written as surplus lines. Both framings can apply to one agreement, which is why market editions are bound by market and regime scopes together (peril vocabulary §9.1), and why the exposure ontology keeps its core market-neutral.

9. Proposed Decisions

For Open CBAA, to be added to the design specification’s decision log once agreed:

10. Phasing

11. Open Questions