Why Scope Comes First
A risk assessment can be detailed and still be unhelpful if it examines the wrong part of the organization, stops at an arbitrary process boundary, or covers a time period that does not match the decision at hand. Scope establishes what the assessment is meant to examine before participants begin identifying or evaluating individual risks.
For example, an assessment of a new claims platform might cover only the insurer’s claims team, or it might also include the technology provider, data transfer, payment operations, and customer communications. Neither scope is automatically correct. The right choice depends on the purpose of the assessment and on whether the covered activities can support the decision being considered. This tutorial is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
Four Boundaries to Specify
A useful scope statement answers four distinct questions. They are related, but none substitutes for another. Naming a business unit does not define which of its processes are included; naming a process does not establish how far into the future the assessment looks.
| Boundary | Question to answer | Typical specification |
|---|---|---|
| Organizational | Which entities, units, locations, or third parties are covered? | One legal entity, its underwriting and claims teams, and named service providers |
| Process | Which activities, handoffs, systems, and interfaces are covered? | From receipt of an application through policy issuance, including data transfer |
| Time | What period or future horizon is considered? | Current operating conditions and material exposures over the next 18 months |
| Decision | Which decision or decisions should the assessment inform? | Whether to approve a system launch, and what conditions are needed before launch |
The organizational boundary should identify the relevant parts of the organization precisely enough to prevent accidental omissions. A corporate name may be too broad if the assessment concerns one product line. Conversely, naming only the department that commissioned the work may be too narrow when another unit performs a critical activity. Legal entities, branches, outsourced providers, and shared services may need to be named separately.
The process boundary describes the work and its interfaces, not just the department responsible for it. State where the process starts and ends, and whether supporting systems, data flows, approvals, and handoffs are included. An interface can be a material source of exposure even when the activity on the other side is outside the assessment’s direct control.
The time boundary is not merely the date when a workshop or review occurs. It should distinguish the evidence period from the forward-looking horizon when both matter. For instance, an assessment may use incident data from the previous three years while considering exposures arising during the next two years. A short horizon may omit long-duration consequences; a very broad one may make the assessment too diffuse for its decision purpose.
The decision boundary specifies what the assessment is intended to inform. It may concern a launch, a change in operating practice, an investment, a control response, or a choice among alternatives. It does not mean the assessment itself makes that decision. Governance and delegated authority still determine who decides and what approvals are required.
A Set-Based Test for Inclusion
Scope can be represented as the intersection of four sets: the covered organizational units, covered activities and interfaces, relevant time period, and decision purpose. This is a practical screening model, not a probability model or a method for measuring risk.
The intersection is useful because a candidate exposure must be relevant to the purpose and connected to the specified boundaries to be assessed directly. However, a strict reading of the intersection should not be used to discard a consequential dependency. If an external provider is outside the organizational boundary but its service is essential to an in-scope process, the provider-related exposure may need to be noted as an interface or referred to the appropriate assessment.
The logic follows directly from the meaning of the boundaries. If the purpose is a decision about a defined process during a stated period, then an exposure unrelated to that process or period cannot inform that decision directly. If an exposure can affect the process or decision through a dependency, it remains relevant even if its source lies outside the direct organizational boundary. This is why scope needs both clear inclusion rules and a way to handle boundary-spanning items.
Worked Applications
Worked Example: Scoping a Policy Administration Change
A hypothetical insurer is deciding whether to launch a new policy administration system for its small-commercial product. The launch is planned in six months. Underwriting enters applications, a technology vendor hosts the platform, and a separate operations team issues policies. Define a practical assessment scope and classify three candidate exposures: (1) incorrect rating rules in the platform, (2) a vendor outage during the first year after launch, and (3) a future change to the insurer’s personal-lines product.
Method. Start with the decision, then set each of the four boundaries. Test each candidate exposure against the defined purpose and record dependencies that cross the direct boundary.
Decision boundary. The assessment informs approval and launch conditions for the small-commercial system. It does not decide whether the insurer should replace its personal-lines platform.
Organizational boundary. Include the small-commercial underwriting and policy-operations teams, the internal technology owner, and the vendor interface. The vendor is not part of the insurer, but its role is explicitly included as a dependency relevant to launch readiness.
Process boundary. Include application entry, rating, policy issuance, and the data and system handoffs between those activities. Exclude claims handling because it is not part of this launch decision.
Time boundary. Consider launch readiness over the next six months and operations during the first 12 months after launch. These are two related periods: preparation and early operation.
Candidate 1. Incorrect rating rules fall within the organizational boundary (internal underwriting and technology owners), the covered process (rating and issuance), the time period, and the launch decision. Classify this exposure as directly in scope.
Candidate 2. A vendor outage originates outside the insurer’s legal organization, but the vendor interface is included and the outage could interrupt the covered process during the first operating year. Classify it as in scope as a third-party dependency, and identify the vendor-related response as something the launch decision may need to address.
Candidate 3. A future personal-lines product change is outside the product and process boundary and does not inform the small-commercial launch decision. Classify it as out of scope for this assessment; refer it to a separate assessment if needed.
Check. Each classification follows from the stated purpose rather than from whether the exposure sounds important in general. The common mistake is to exclude the vendor outage solely because the vendor is external. The correction is to distinguish organizational ownership from process dependency: a source can be external while its effect remains relevant to an in-scope decision.
Worked Example: Reconciling a Process Boundary With a Shared Service
A hypothetical insurer is reviewing premium collection for one product. The assessment covers 1,200 scheduled collections during a three-month pilot. The product team prepares the files, a shared-service unit transmits them to a bank, and the bank returns payment status. The pilot decision is whether to expand the collection process to 2,000 accounts. During the pilot, 18 files were rejected before reaching the bank, and 12 files were transmitted but received no status response by the end of the pilot. Classify the two observations for the assessment and state the implication for scope.
Method. Define the process by its start and end points, then locate each observation in relation to those points. Do not assume that a handoff is outside scope merely because a different unit performs it.
Organizational boundary. Include the product team and the shared-service unit because both perform steps in the pilot. The bank is an external interface; include the transmission and response dependency, but do not claim that the bank’s internal operations are directly assessed.
Process boundary. Start when the product team prepares a collection file and end when the insurer receives and records the bank’s status response. This includes file preparation, transmission, and status receipt.
Time and decision boundaries. The evidence period is the three-month pilot, with the results used to decide whether to expand to 2,000 accounts. The pilot’s 1,200 scheduled collections are the relevant activity volume; the proposed expansion is the decision being assessed, not additional pilot experience.
Rejected files. The 18 files were rejected before reaching the bank, but file preparation and transmission are within the process boundary. Therefore, the rejections are in scope. The count is \(18\) out of \(1{,}200\), or \(18/1{,}200=0.015=1.5\%\) of scheduled collections.
Missing responses. The 12 files were transmitted but lacked a status response by the end of the pilot. Because receipt and recording of status is the process endpoint, these observations are also in scope as unresolved boundary-spanning items. Their observed proportion is \(12/1{,}200=0.01=1.0\%\).
Check. The counts are calculated from the same denominator of 1,200 scheduled collections, and the two categories should not be added into a combined rate unless they are known to be mutually exclusive. The common mistake is to stop the process boundary at transmission and treat missing responses as someone else’s issue. The correction is to define the endpoint based on the decision-relevant outcome—recorded status—and explicitly include the handoff. The figures describe pilot observations only; they do not establish a future rate for the expanded process.
Worked Example: Separating Evidence Period From Exposure Horizon
A hypothetical insurer is deciding whether to renew a three-year contract for a data-processing service. The assessment will use incident records from the last two completed years. The proposed renewal would begin next January and run for three years. A material service failure could disrupt monthly reporting, while a planned migration is expected near the end of the contract’s second year. State the time scope and decide whether the migration should be considered.
Method. Separate the historical evidence window from the forward-looking exposure horizon, then test the candidate event against the renewal decision and the future period covered by the contract.
Evidence window. Use the last two completed years of incident records. This window describes the evidence available for the assessment; it is not the full time boundary for prospective exposure.
Forward horizon. Cover the full three-year renewal term beginning next January. This aligns the assessment horizon with the contract choice. The monthly reporting dependency is relevant throughout that term.
Migration. The planned migration occurs near the end of contract year two, which is within the three-year term. It can affect service continuity and the renewal decision, so include it in the assessment scope even though it has not yet occurred.
Check. The two-year incident window and three-year future horizon answer different questions and are not contradictory. The common mistake is to use only the historical evidence period and thereby omit a known change during the proposed contract term. The correction is to label past evidence and future exposure separately. The migration is not treated as a past incident; it is a future condition relevant to the decision.
Documenting and Managing the Boundary
A concise scope record should be specific enough that another reviewer can classify a borderline item in the same way. It should state the purpose, the four boundaries, key assumptions, exclusions, and how dependencies outside the direct boundary will be handled. Where the work is expected to support several decisions, name them rather than relying on a broad phrase such as “enterprise risk review.”
Identify the decision, its owner or approving forum where known, and the expected timing. Distinguish advice from authority to decide.
Name included units and activities, define start and end points, and identify material handoffs, systems, or external dependencies.
Record the historical evidence period separately from the forward-looking period relevant to the decision.
For each important exclusion, state why it is outside scope and where a consequential related issue should be considered.
If the proposed activity, timeline, participants, or decision changes materially, check whether the existing boundaries still support the purpose.
Scope is a practical control on completeness and relevance. An overly narrow boundary may omit a handoff, shared service, or future period that can affect the decision. An overly broad boundary may dilute attention and make the assessment difficult to use. The goal is not to include every conceivable exposure; it is to include what can materially inform the stated decision and to make the treatment of adjacent issues explicit.
Common Scope Errors
- Using a department as a substitute for a process. A process may cross several departments. Define activities and handoffs as well as organizational ownership.
- Treating external as irrelevant. An external provider may be outside direct organizational control but still be a material dependency for an in-scope activity.
- Confusing past evidence with future exposure. State the observation period and forward horizon separately so known future changes are not omitted.
- Leaving the decision implicit. Without a decision purpose, it is difficult to judge which boundaries are appropriate or which exclusions are defensible.
- Using exclusions to hide unresolved dependencies. An item may be outside the assessment’s direct boundary while still requiring referral, coordination, or a documented assumption.
Check Your Understanding
For each problem, apply the boundaries in the situation rather than relying on whether an exposure appears important in isolation.
- A hypothetical insurer assesses a new broker portal. The decision is whether to launch in eight months. The assessment covers submission upload through underwriting receipt, including the data handoff, and the first six months of operation. A broker’s internal employee scheduling is proposed as an item. Classify it and explain the boundary test. (Answer: Out of scope as stated; the broker’s internal scheduling is not part of the defined portal process or launch decision, unless a specific dependency on portal submissions is established.)
- A hypothetical claims team reviews a six-month pilot covering 900 claims. Its stated process endpoint is payment confirmation to the claimant. Forty-five claims were approved but had no recorded payment confirmation by the end of the pilot. What is the observed proportion and are those claims in scope? (Answer: In scope; \(45/900=0.05\), or 5.0% of pilot claims lacked recorded payment confirmation.)
- A hypothetical insurer uses three years of past vendor incidents to assess a proposed two-year renewal. A system replacement is planned during the first renewal year. Should the replacement be included, and what time periods should be stated? (Answer: Include the replacement as a future exposure relevant to the renewal decision; state the three-year historical evidence window separately from the two-year forward renewal horizon.)
- A hypothetical insurer assesses a new billing process. Its own team prepares files, a shared-service unit transmits them, and an external bank returns results. The assessment endpoint is receipt of results; the shared-service unit is omitted from the draft organizational scope. What boundary correction is needed? (Answer: Add the shared-service unit to the covered organizational boundary and retain the bank transfer and response as an external dependency through the stated endpoint.)
- A hypothetical insurer scopes a decision to expand one commercial product in two regions over the next year. A separate personal-lines system upgrade is occurring in the same year. What additional information would justify including the upgrade? (Answer: Evidence that the upgrade can materially affect the commercial product’s covered process or the expansion decision; calendar overlap alone does not put it in scope.)