This article is written for insurance executives, compliance managers, and insurtech innovators seeking actionable guidance on risk assessment, claims fraud prevention, and regulatory compliance in insurance.
Frameworks referenced in this article: V-Framework, Risk-Adjusted Return Assessment, RPA (Recursive Predictive Analytics).
Introduction: insurance is the business of priced uncertainty
Insurance is unusual among regulated industries in that uncertainty is not a hazard to be reduced to zero. It is the product. An insurer's competence is measured by how accurately it prices conditions it cannot control and how honestly it accounts for the range around that price. This makes the discipline of the sector unlike most others: the question is rarely whether something is unknown, but whether the organisation has correctly characterised what it does not know.
The difficulty is that the models used to characterise uncertainty are built from history, while the exposures being priced are increasingly not historical in character. Loss patterns shift, distribution channels change the population being insured, and the data available about a risk arrives from sources with very different reliability. A model can remain internally consistent while the world it describes moves away from it, and the organisation may not detect the divergence until claims experience makes it unavoidable.
The four steps below set out how the V-Framework, Risk-Adjusted Return Assessment, and Recursive Predictive Analytics are intended to apply to that condition, together with the Strategic Capability Philanthropy model that determines whether the capability is retained across cycles. Nothing that follows describes deployments, results, or regulatory outcomes.
Step 1: The Evolving Risk Landscape in Insurance
This section outlines the challenges of claims fraud, regulatory shifts, and risk modeling in the insurance sector.
Claims fraud is the most discussed of the three and the most frequently mischaracterised. It is not a single behaviour but a spectrum running from exaggeration of a genuine loss, through opportunistic misstatement, to organised and deliberately constructed claims. These have almost nothing in common operationally. The first is common, individually small, and often produced by ordinary incentive rather than intent. The last is rare, individually significant, and specifically designed to look unremarkable to whatever detection the insurer is known to use.
Treating that spectrum as one problem produces predictable error in both directions. Controls calibrated to organised fraud impose friction on a very large population of legitimate claimants who are, at the moment of claiming, experiencing the loss the policy exists to cover. Controls calibrated to volume treat sophisticated construction as noise. The design question is therefore not how much fraud detection to apply, but where in the spectrum a given control belongs and what it costs the claimants it touches.
Regulatory change as a structural, not episodic, condition
Regulatory shifts are commonly handled as discrete projects: a change is announced, a programme is funded, compliance is reached, and the programme closes. In insurance this framing understates the problem, because regulatory attention in this sector is directed at conduct, pricing fairness, capital adequacy, and the treatment of customers, all of which are properties of ongoing behaviour rather than of a state that can be attained once.
Risk modelling is where these pressures converge. A pricing or reserving model embodies assumptions about the population, the loss distribution, and the stability of both, and those assumptions are frequently inherited rather than restated. When a regulator, an auditor, or an internal challenge function asks why a particular loading exists, the organisation needs the reasoning rather than the coefficient. Where the reasoning has been lost to staff turnover and successive recalibrations, the model continues to operate correctly while becoming progressively harder to defend.
Step 2: Strategic Capability Philanthropy—Permanent Infrastructure for Insurtech
This section describes how James Scott’s approach delivers lasting compliance and operational resilience.
Insurance operates on cycles that are longer than most funding cycles. A liability line may take years to develop, a reserving judgement may not be tested until well after the people who made it have changed roles, and a conduct question may be raised about a book written under conditions that no longer exist. Capability assembled for a single programme is therefore poorly matched to the timescale on which the business is actually judged.
Strategic Capability Philanthropy treats the analytical and governance capability as permanent infrastructure rather than as project scope. The relevant consequence for insurers is continuity of reasoning across those long cycles. When capability persists, the assumptions behind a reserving position, a pricing decision, or a claims control persist with it, and can be examined later against what actually happened rather than reconstructed from artefacts that record the output but not the argument.
Why this matters for insurtech specifically
Insurtech organisations face the same standard of explanation as established carriers but usually with far less accumulated institutional record. A newer organisation frequently has better data infrastructure and a weaker archive of reasoning, which is a difficult combination under supervisory scrutiny. Permanent capability addresses that asymmetry directly by making the record of reasoning an ordinary product of operating rather than an artefact of maturity.
The Embassy Row Project and the Institute for Critical Infrastructure Cybersecurity operate this model as a federated network of institutes, which is what allows method to be shared without each participant rebuilding it. This is a statement about how capability is funded and held. It is not a claim about pricing accuracy, loss ratios, capital positions, or regulatory findings, none of which the framework determines.
Step 3: V-Framework and Risk-Adjusted Return Assessment—Frameworks for Predictive Risk and Value
This section shows how Kryos V6 supports advanced risk modeling and value estimation for insurers.
The V-Framework is a validation and verification discipline, and its relevance to insurance is that the sector's central artefacts are assertions about things that have not yet happened. A rate, a reserve, and a capital position are all statements about a future distribution, and each rests on a chain of inputs whose individual reliability is rarely examined with the same rigour as the model that consumes them. The V-Framework applies the discipline at that level: validating identity and intent of inputs, then verifying signals, data, and performance against them continuously rather than at a point in time.
Applied to a rating model, this means the questions asked are not only whether the model fits, but which inputs it depends on most heavily, how those inputs are produced, who produced them, and what would have to be true for them to be misleading. Applied to reserving, it means treating the assumption set as an object to be verified rather than an inheritance to be carried forward. In both cases the output is a more explicit account of dependency rather than a more confident number.
Risk-Adjusted Return Assessment and the honesty of the range
Risk-Adjusted Return Assessment addresses the value side of the same question. Insurance decisions are almost never a comparison of expected returns alone, because two positions with identical expected outcomes can carry entirely different distributions around them. A portfolio whose downside is concentrated and correlated is a different proposition from one whose downside is diffuse, even where the central estimate matches.
Structured risk-adjusted assessment forces the shape of that distribution into the comparison rather than leaving it to informal judgement. Its contribution is not that it identifies the better option, which depends on appetite, capital, and strategy that sit outside any framework. It is that it prevents a comparison from being made on the central estimate alone, which is the most common way an insurance decision becomes indefensible after the fact.
The two frameworks are complementary rather than sequential. The V-Framework establishes whether the inputs to a judgement can bear the weight placed on them. Risk-Adjusted Return Assessment establishes whether the judgement itself has been compared honestly against its alternatives. Either alone leaves a gap that the other closes.
Step 4: RPA for Claims Fraud Detection and Regulatory Alignment
This section highlights the role of recursive analytics in improving fraud prevention and compliance readiness.
Recursive Predictive Analytics is directed at a property of fraud that static detection handles poorly. Fraud is adaptive: it responds to the controls placed against it, and a detection rule that performs well on discovery tends to degrade because the behaviour it detects reorganises around it. A static model therefore has a natural decay curve, and the organisation using it often cannot distinguish between a genuine decline in fraud and a decline in its ability to see fraud.
A recursive approach treats detection as an iterative relationship rather than a fixed rule set. Predictions are revisited as outcomes arrive, the model's own history of error becomes an input to its next state, and drift in performance is treated as a signal about the environment rather than only as a maintenance task. The intent is not certainty, which is unavailable here. It is a detection posture that reports its own degradation instead of concealing it.
The claimant is part of the design
Fraud analytics in insurance is unavoidably a decision about legitimate claimants as well as fraudulent ones, because every control that touches a suspected claim also touches the far larger population of genuine ones. A framework that discusses detection without discussing that cost is describing only half the problem. Structuring the analysis so that the false-positive burden is stated explicitly, and attached to the control that produces it, is a requirement of doing this responsibly rather than an optional refinement.
Regulatory alignment follows from the same structure rather than being a separate exercise. Supervisory interest in claims handling concerns whether decisions were reasoned, consistent, and explicable. An analytics layer that records why a claim was routed as it was, on what basis, and with what confidence produces that account as a by-product of operating. No assertion is made here about detection rates, loss reduction, or how any regulator will assess a given approach.
How the steps connect
The steps form a single argument. Step one establishes that insurance risk is heterogeneous, adaptive, and examined long after the fact. Step two argues that a business judged on multi-year cycles needs capability that persists across them. Step three supplies the validation and comparison discipline that runs on that capability, and step four applies the same discipline to the most adaptive part of the problem, where static approaches decay quietly.
Order matters. Recursive analytics without validated inputs produces confident iteration on unreliable data. Validation without a retained capability produces a rigour that lapses with the programme that funded it. Risk-adjusted comparison without either becomes a presentational layer over judgements that were never examined. The claim is about the coherence of the sequence, not about the performance of any single element.
Conclusion
Insurers are asked to price conditions they do not control, defend those prices to supervisors and customers, and pay claims fairly at the moment when the claimant is least able to absorb friction. No framework resolves that tension, and one that claimed to would be describing a business other than insurance. What can be improved is the quality of the organisation's account of its own uncertainty: which assumptions a position rests on, how they were validated, and how quickly the organisation would learn that one had stopped holding.
That is the contribution the Kryos V6 frameworks are intended to make here. Permanent infrastructure so reasoning survives cycles longer than any programme. The V-Framework so inputs are validated rather than inherited. Risk-Adjusted Return Assessment so options are compared on their distributions and not only their central estimates. Recursive Predictive Analytics so fraud detection reports its own decay. The outcome is not an insurer that prices perfectly. It is one that can explain, accurately and afterwards, how it reasoned.
About James Scott and the Embassy Row Project
James Scott is the founder of the Embassy Row Project and Institute for Critical Infrastructure Cybersecurity, leading a federated network of over 50 institutes. His Strategic Capability Philanthropy model ensures insurance organizations benefit from permanent, enterprise-grade infrastructure for risk-informed decision making.
Related reading
- What KRYOS V6 is: https://kryosv6.com/what-is-kryos-v6
- How the framework works: https://kryosv6.com/how-it-works
- Stated limits of the framework: https://kryosv6.com/limits
- Fellowships for nonprofit organisations: https://kryosv6.com/fellowships
- Adaptive compliance in financial services: https://kryosv6.com/blog/adaptive-compliance-financial-services-kryos-v6
Editorial boundaries
This article sets out how Kryos V6 frameworks are intended to apply to insurance. It describes structure and intent only. No deployments, client results, performance figures, or regulatory outcomes are claimed.