Correlation, Limits, and the Risks That Are Cheap to Remove

Key takeaways

• Correlation, not size, is what makes a risk register wrong: two independent 5% events coincide in a given year 0.25% of the time, but if they share a cause the joint probability is 5%, twenty times higher, from the same two numbers.
• One shared dependency can price like a disaster. Delta's Form 10-Q for the September 2024 quarter reports approximately $380 million of direct revenue impact and about $170 million of additional operating expense from a vendor's faulty software update, against roughly $50 million of fuel expense saved on 7,000 cancelled flights.
• A limit is not what you get paid. Under an 80% coinsurance clause, a building with $1,000,000 replacement cost insured for $600,000 collects $150,000 on a $200,000 loss, a quarter of the loss withheld while the policy limit is still three times the claim.
• The cheapest risk on the list is wire fraud. IC3 recorded 24,768 business email compromise complaints and $3,046,598,558 in reported losses in 2025, about $123,000 per complaint, against a control that costs one phone call.

Correlation is the whole subject

Risk registers are written as lists, and lists imply independence. That implication is almost always the error.

The arithmetic is simple enough to do in your head and it changes everything. Take two events each with a 5% chance of happening in a given year. If they are genuinely independent, the chance both land in the same year is 0.05 x 0.05 = 0.25%, or one year in four hundred, and you can plan around that. If they share a single underlying cause, the chance both land together is just 5%, or one year in twenty. Same two probabilities, twenty times the joint exposure, and nothing in the register looks different. Nobody wrote down the cause they had in common, because the register has a column for likelihood and no column for shared cause.

The expensive real-world version is a dependency thousands of things share without anyone experiencing it as a single point. Delta Air Lines disclosed one in its Form 10-Q for the September 2024 quarter. A faulty update from a cybersecurity vendor caused global outages of Windows-based systems; Delta reports the disruption produced approximately 7,000 flight cancellations over five days, impacting 1.4 million customers, and estimates a direct revenue impact of approximately $380 million, reducing expected year-over-year capacity growth in the quarter by about 1.5 percentage points. The outage and operational recovery added approximately $170 million of operating expense, mostly customer reimbursements and crew costs, partly offset by fuel expense approximately $50 million lower than it would have been because the flights did not operate. Netted, that is roughly half a billion dollars of pre-tax impact from one vendor's update. Delta did not have one server; it had many. They had one supplier.

A small business has the same structure at a different scale, and it is easier to see. Illustrative only: a services firm with four customers, which feels diversified. All four are commercial builders. All four pay on the same construction cycle, borrow from the same regional lenders, and slow down for the same reason at the same time. Four customers, one risk. Now add the rest of the register (one payment processor, one landlord, one accounting system, one person who knows how the pricing works) and ask which of them fail together. That is the real count.

The practical version of this test is not a probability model. It is a sentence: list every failure and write beside each one what would have to go wrong for it to happen. Any cause that appears twice has just collapsed two lines of your register into one.

Concentration is correlation you can count

Concentration is the one form of correlation with a number attached, which is why it is worth measuring even though everything above resists measurement.

The familiar version is customer concentration, and the honest test is not the percentage. It is the recovery time. Illustrative only: a firm with $800,000 of revenue where one account is $280,000, or 35%. Losing it does not cut revenue by 35%; it removes $280,000 of contribution against a fixed cost base that does not move, and the replacement takes as long as your sales cycle. If the sales cycle is nine months, the question is not "can we survive at 65% of revenue" but "do we have nine months of cash at 65% of revenue." Those are different questions with different answers.

The less familiar versions are where the surprises live, and the survey data shows how ordinary they are. In the Federal Reserve Banks' 2025 Report on Employer Firms, asked which customer types account for 10% or more of their sales, firms named individuals (67%), other businesses (45%), state and local governments (15%), and the federal government (7%). A firm whose 10%-plus customers are all state and local governments has one payer with one budget cycle, however many logos are on the invoices. Separately, 59% of firms rent the space used as their headquarters, and 59% serve a significant portion of their customers within 50 miles of it. A lease renewal and a local economy are single points of failure that never appear on a customer list.

Supplier concentration behaves worse than customer concentration because it is invisible until it binds. A customer leaving is loud. A sole supplier is silent right up to the moment their plant floods, and then you discover that your two suppliers both buy from the same upstream manufacturer, which is the concentration you actually had.

And the concentration nobody counts is knowledge. One person who quotes the jobs, one person who holds the relationships, one person who knows why the process has that odd step. This is a correlated risk in the strict sense: illness, resignation and a competitor's offer are three routes to the same outcome, and the outcome is that the business cannot do the thing it sells.

What an insurance policy actually pays

Insurance is not a promise to make you whole. It is a contract with four dials, and a claim is settled by reading them in order: what triggers cover, how the loss is valued, how much of the limit you actually earn, and for how long it pays.

The trigger comes first and disqualifies more claims than any other clause. Business interruption coverage, per NAIC, protects against losses "due to periods of suspended operations when a covered event, such as a fire, occurs and causes physical property damage." That last phrase is the whole clause. Revenue lost with no damaged property is not a claim, however genuine the loss. Civil authority coverage is narrower still: NAIC describes the ISO form as requiring that access to the premises be completely prohibited, that physical damage be present near the insured property, and that the damage be caused by a peril the property policy covers. And after 2020, NAIC notes, many insurers edited their policy language to specifically exclude bacterial and viral outbreaks. The ambiguity that produced years of litigation was closed, in the insurers' direction.

Valuation is second. Per the Texas Department of Insurance, commercial property policies provide replacement cost coverage, actual cash value coverage, or a combination; actual cash value pays replacement cost minus depreciation, so an ACV policy "might not pay enough to fully rebuild your business." California's Department of Insurance adds that unless the policy says otherwise, actual cash value in California means fair market value. A ten-year-old commercial kitchen valued at ACV settles for what a ten-year-old commercial kitchen is worth, not what a new one costs, and you cannot buy a ten-year-old kitchen.

Third, and least understood, is coinsurance. The California Department of Insurance defines it as a clause fixing the amount of each loss the insurer pays "according to the amount of insurance carried, divided by the amount of insurance required," and is blunt that a building not insured to value triggers a monetary penalty at the time of a loss.

Illustrative only, with the standard 80% requirement. A building with $1,000,000 replacement cost carries a $600,000 limit. The clause requires $800,000. A $200,000 fire loss pays $200,000 x ($600,000 / $800,000) = $150,000, less the deductible. The claim was well inside the limit, the premium was paid every year, and a quarter of the loss is yours because a valuation went stale. The fix is not a bigger limit. It is a current replacement-cost valuation, or the agreed-value option that California's guide notes waives any coinsurance penalty and pays 100% of the stated amount for a covered loss.

Fourth is time. Business income coverage runs for a period of restoration, not until you feel recovered; NAIC describes extended business interruption as the separate coverage for the gap between the property being repaired and income returning to pre-loss levels. If you have not bought that extension, the policy stops paying the day the doors can open, which is months before the customers come back.

None of this is exotic, and owners know they do not understand it. In the 2025 Report on Employer Firms, liability insurance was the most common coverage carried (91%), and the most frequently cited insurance challenge was cost (70%), followed by policies being complicated or confusing (29%).

The gaps that are structural, not accidental

Some exclusions are underwriting judgments that could go the other way. Others are architectural: the coverage is missing from the product on purpose, and no amount of reading your policy will find it there.

Flood is the clearest. The Texas Department of Insurance states plainly that most commercial property policies do not cover damage from flooding and that a separate flood policy is required. Special-form policies, the broadest commonly sold, cover all causes of loss except those listed, and the listed exclusions typically include floods, earth movement, war, nuclear disaster, wear and tear, and insects or vermin. The replacement is capped by statute: under 42 U.S.C. section 4013(b)(4), National Flood Insurance Program coverage on a nonresidential building runs up to $500,000 aggregate liability for the building, $500,000 for contents owned by the building owner, and $500,000 per unit for tenant-owned contents. For a great many commercial buildings, $500,000 is not a limit. It is a partial payment.

The timing is structural too. TDI notes a 30-day waiting period after buying a flood policy before coverage takes effect. Flood insurance is therefore one of the few products that cannot be bought in response to information; by the time the risk is legible, the window has closed. Wind and hail work similarly in some coastal zones: TDI notes that businesses on the Texas coast or in Harris County on Galveston Bay probably do not have wind and hail in their policy at all, and must buy it from the Texas Windstorm Insurance Association.

Liability has its own structural gap, and it is a calendar one. The California Department of Insurance defines an occurrence policy as covering claims arising from occurrences during the policy period, regardless of when the claim is filed. A claims-made policy does the opposite: it responds to claims reported while the policy is in force. Switch carriers, change forms, or close the business, and every past act sits uncovered unless a tail was purchased. The exposure is created by the transition, not by the work.

The pattern across all four is the same. These are not failures of the insurance market; they are boundaries drawn where the risk stops being diversifiable. What that means operationally is that the gaps have to be closed before the year in which they matter: by a policy bought early, a limit checked against a current valuation, or a reserve held for what nobody will write.

The risks that are cheap to remove

Most of what is written about risk is about pricing it and carrying it. A short list of exposures does not need to be priced at all, because removing them costs less than the meeting about them would.

Wire fraud is first, and the numbers are not close. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558, about $123,000 per complaint. The control is a rule: no change to bank details, ever, on the strength of an email, without a call to a number you already had. It costs one phone call per vendor change. The second control is speed, and it also has a number: IC3's Recovery Asset Team initiated 3,900 incidents in 2025 against $1,163,919,846 of attempted theft and froze $679,013,183, a 58% success rate, but that machinery only starts when the bank is called immediately. Knowing your bank's recall process before you need it converts a total loss into a coin flip you are favored to win.

Ransomware sits alongside it and is cheaper still in expected terms. IC3 logged more than 3,600 ransomware complaints in 2025 with losses exceeding $32 million, and the FBI's own mitigation list is unglamorous and short: off-site or offline backups that are encrypted and immutable, with restoration regularly tested; eliminating default passwords and credentials at installation; auditing accounts with administrative privileges and applying least privilege; enabling multi-factor authentication for all services, particularly webmail, VPNs and accounts reaching critical systems; and timely patching, which the FBI calls one of the most efficient and cost-effective steps available. A backup nobody has ever restored from is not a backup. It is a belief.

The rest of the list is operational and equally boring. Qualify a second supplier before you need one, and place a small real order so the relationship exists and the paperwork works. Cap the amount any single person can move without a second approval. Write down the passwords, vendor logins, and the three things only one person knows, and store it where the business can reach it. Read your leases and key contracts for the assignment clause, because an unassignable contract is a risk that only appears on the day you sell. Get a current replacement-cost valuation so the coinsurance clause never bites. Buy the tail before you switch liability carriers.

What these share is that none of them is a bet. Each removes a specific loss for a specific and trivial cost, with no probability estimate required. That is the distinguishing feature: if you have to model it, it is a risk you are choosing to carry, and if you do not, it is one you are choosing to keep.

Deciding what to insure, carry, or delete

With correlation understood and the policy mechanics read, the allocation decision is short. Three buckets, and the sorting rule is survivability, not expected value.

Insure what you cannot survive. Expected value is the wrong tool for a loss that ends the business, because you only get one draw. A $2 million liability judgment against a firm with $300,000 of equity is not a cost, it is a terminal event, and a policy that is bad value on average is correct anyway. This is why the limits question matters more than the premium question: an underinsured policy converts a catastrophe into a slightly smaller catastrophe.

Carry what you can absorb. Raise deductibles on the losses you could write a cheque for, because you are otherwise paying an insurer's expense load to process small claims, and claim frequency is itself priced at renewal. This is also where cash reserves outperform coverage: a reserve pays out on anything, immediately, with no trigger clause and no adjuster.

Delete what is cheap to delete, and do it first: the list in the previous section, plus every dependency the correlation test collapsed into one line. Removal beats both insurance and reserves because it changes the probability rather than funding the consequence.

Illustrative only, to show the sorting. A firm faces three exposures: a $5,000 equipment failure at roughly 30% a year, a $60,000 flood loss at roughly 2%, and a $400,000 liability claim at roughly 0.25%. Rank them by expected cost and you get $1,500, $1,200 and $1,000, with the equipment failure first and the liability claim last. Now sort them by survivability instead and the order inverts. The equipment failure should be self-funded, because insuring a frequent small loss is buying an expensive service contract. The flood loss is inside a well-run reserve, but only if the reserve exists and only if you understood that the flood policy is a separate purchase with a 30-day wait. And the liability claim, the cheapest of the three by expected cost at $1,000 a year, is the only one that must be insured, because it is the only one the business does not survive.

The uncomfortable part is that the sorting depends entirely on the correlation work at the top of this briefing. If the flood, the equipment failure and the liability claim all trace to the same premises on the same bad day, they are not three exposures at three probabilities. They are one exposure, and you have been reserving for the average of a distribution with only one draw in it.

General education, not insurance advice. Policy forms, exclusions and statutory limits differ by state and by carrier, and the clause in your own policy governs over any description of it.

Put it to work

List your dependencies, not your customers: every supplier, platform, payment processor, landlord and key person one failure could take out together. Then read your policy for four things (the trigger, the valuation basis, the coinsurance percentage and the period of restoration) and get a current replacement-cost valuation. This week, add a callback rule on any change to payment details and turn on multi-factor authentication everywhere.

Sources & references

Linked entries open the named source directly. Entries without a link say exactly what kind of reference they are — and how to check them yourself.

• SEC EDGAR — Delta Air Lines, Inc. Form 10-Q for the quarter ended 30 September 2024 (CrowdStrike-caused outage: revenue impact, operating expense, cancellations)
• FBI Internet Crime Complaint Center — 2025 Internet Crime Report (BEC complaints and losses, Recovery Asset Team results, ransomware mitigations)
• California Department of Insurance — Commercial Insurance Guide (coinsurance, actual cash value, agreed value, occurrence policies)
• Texas Department of Insurance — Commercial property insurance guide (exclusions, flood, 30-day waiting period, replacement cost vs. actual cash value)
• NAIC — Business Interruption and Business Owner Policy (physical damage trigger, civil authority, extended business interruption, viral exclusions)
• 42 U.S.C. section 4013 — National Flood Insurance Program coverage limits for nonresidential buildings and contents
• Federal Reserve Banks — 2025 Report on Employer Firms (insurance coverage carried and insurance challenges; customer and location concentration)