Probable Maximum Loss (PML) Assessment
Scenario-based loss quantification, recovery analysis and insured limit adequacy for critical infrastructure
Energy · Infrastructure · Engineering & EPC · Insurance & Reinsurance · Project Finance · Development Banks
When a project is built in a contested environment, two things decide the size of the loss: which critical dependency fails, and how much of that failure actually reaches the commercial operation date. Neither is solved by a percentage applied to the insured value. ACK3 assesses Probable Maximum Loss against sabotage, terrorism, strikes, riot, civil commotion and malicious damage, integrating material damage, recovery time and Anticipated Loss of Profit into one traceable technical basis. From plants under construction to assets in operation, we help organisations know whether the limit they have placed answers the scenario that can genuinely happen.
Analytical depth. Traceable numbers.
Estimating what a project can lose is not a percentage applied to the insured value. ACK3 builds the threat picture, identifies the dependencies whose failure carries consequences out of proportion to their cost, quantifies material damage and the recovery path behind it, separates gross recovery time from the delay that genuinely reaches the commercial operation date, and tests the resulting figure against the limits and sublimits actually placed.
What a PML Assessment is
A structured estimate of severe but reasonably plausible loss, built scenario by scenario. Not a prediction, not an MFL, not a worst case. Every material figure identifiable as documented input, professional assumption or calculated output.
The severity is in the dependencies, not in the value
The assets that decide a loss are rarely the most expensive ones. A single transformer, a substation bay, an access route: individually a fraction of the works value, collectively the difference between a contained incident and a project that misses its COD by half a year. Our assessment separates economic weight from functional criticality, and follows each critical dependency through to its replacement lead time — manufacture, transport, installation, testing and commissioning included.
Damage is not the same as delay. What reaches the commercial operation date is what reaches the balance sheet.
A PML is a decision tool, not a percentage of the insured value
Two questions decide how much a project can lose in a contested environment: which dependency fails, and how much of that failure reaches the commercial operation date. Neither is answered by applying a factor to the works value. ACK3 Probable Maximum Loss Assessment quantifies severe but reasonably plausible loss scenarios arising from sabotage, terrorism, strikes, riot, civil commotion and malicious damage — integrating material damage, recovery time and Anticipated Loss of Profit into a single traceable figure. It forms part of our Risk Management capabilities.
Where the assessment comes from
A PML built by an engineering firm tends to model the asset well and the threat poorly. A PML built by a security consultancy tends to do the reverse. ACK3 works from the intersection, drawing on capabilities the firm applies daily:
Threat and vulnerability assessment in jurisdictions marked by social conflict, criminality and political instability · analysis produced by our Strategic Knowledge Unit and monitoring through our Global Risk Operations Centre · protection of critical infrastructure and assessment of physical, electronic and procedural controls · risk advisory to energy, engineering and infrastructure projects across Latin America, the Middle East, Africa and Asia · review of insurance documentation to contrast modelled scenarios against the limits and sublimits actually placed.
What the assessment covers
Scope areas
The assessment is organised around four areas. Each feeds the next, and each is documented separately in the final report.
| Area | What it includes |
|---|---|
| Threat & vulnerability assessment | Structured evaluation of threat, exposure, vulnerability, existing controls, functional criticality and potential severity, directed specifically at identifying loss mechanisms. |
| Loss scenario development | Construction of coherent scenarios and selection of those whose combination of plausibility and severity makes them material to the project. |
| Damage, recovery & COD impact | Quantification of material damage, the full recovery path behind it, and the delay that genuinely reaches the commercial operation date and generates ALOP. |
| Insurance architecture contrast | Comparison of modelled results against limits, sublimits and the continuity between construction, cargo and delay covers, including reverse stress testing. |
How the assessment is built
The sequence moves from understanding the environment to quantifying the loss. It is not linear in practice: what emerges during quantification frequently sends the analysis back to the threat picture.
Understanding the exposure
| Stage | What it involves |
|---|---|
| Threat & vulnerability | Assess the environment against the perils actually listed in the cover, distinguishing economic value from functional criticality. |
| Scenario identification | Build loss mechanisms that connect threat, exposure, vulnerability, a critical dependency and a consequence. |
| Scenario selection | Filter by plausibility, criticality, single points of failure, recovery difficulty and relevance to the insurance structure. |
Quantifying the loss
| Stage | What it involves |
|---|---|
| Material damage | Estimate physical damage to the assets affected in each determining scenario, from documented values wherever they exist. |
| Recovery & net delay | Trace assessment, engineering, spares, manufacture, transport, installation, testing and commissioning against float, critical path and acceleration capacity. |
| ALOP | Translate the net delay attributable to COD onto the contracted delay exposure and its maximum indemnity period. |
| PML determination | Combine damage and delay per scenario and identify the one producing the largest loss under central assumptions. |
| Sensitivity | Lower, central and upper cases to test how far the conclusion holds against harsher assumptions. |
| Reverse stress test | Instead of asking what a scenario costs, determine what combination of damage and delay would be needed to reach the placed limit. |
How each figure is classified
A PML is only defensible if a reader can tell, at any point, what is a contractual fact and what is a professional judgement. Every material figure carries its classification.
| Classification | Meaning |
|---|---|
| Documented input | A value taken directly from project, contractual or insurance documentation. |
| Analysis | A technical interpretation made by ACK3 on the basis of the available evidence. |
| Modelling assumption | A hypothesis required to model a scenario where documentation cannot settle the point. Always stated explicitly. |
| Calculated output | A result derived mathematically from the inputs and assumptions above. |
| Insurance review | A technical reading of the insurance documentation for the purposes of the assessment. Not a legal opinion on cover. |
A generic report gives you a number. ACK3 gives you a number you can defend line by line — with the assumptions behind it visible, and the review points that should trigger an update already identified.
Who we support and how we work
Sectors
| Sector | What the requirement looks like |
|---|---|
| Developers & independent power producers | Assets under construction in markets where social conflict or instability can reach the schedule before it reaches the fence line. |
| EPC contractors & engineering | Exposure concentrated in interconnection, long-lead equipment and the handover points between transport, erection and commissioning. |
| Insurers, reinsurers & brokers | A traceable scenario basis for sizing capacity, sublimits and conditions on political violence and specified perils cover. |
| Project finance & infrastructure funds | Lender requirements on the adequacy of cover, and evidence that delay exposure has been quantified rather than assumed. |
| Development banks & multilaterals | Assets in jurisdictions where the threat environment forms part of the investment case, not a footnote to it. |
| Industrial & infrastructure operators | Operating assets where a single point of failure carries consequences far beyond its replacement cost. |
Engagement models
| Model | Best suited to |
|---|---|
| Single asset assessment | One project, ahead of placement, renewal or a lender review. Delivered remotely from documentation and working sessions. |
| Assessment with site visit | Where the threat environment, the construction stage or the value at risk justifies verifying controls in place rather than on paper. |
| Portfolio review | Several assets assessed on a consistent basis, so exposure can be compared across a portfolio rather than asset by asset. |
| Update cycle | Periodic revision as construction advances, the schedule moves or the threat environment changes. A PML is a dynamic assessment. |
| Framework agreement | Recurring demand across programmes or a broking panel, with agreed methodology, rates and turnaround. |
Integrated with ACK3 capabilities
A PML identifies where the exposure sits. Reducing it is a separate piece of work. Depending on the findings, the assessment can be followed by:
| ACK3 capability | How it connects |
|---|---|
| Risk Management | Early warning and monitoring of protest activity, blockades, threats against infrastructure and route disruption. |
| Crisis Management | Response and recovery planning for the scenarios the assessment identifies as determining. |
| Mission Support Services | Operational support on the ground where the project sits and infrastructure is limited. |
| Due Diligence & KYC | Verification of contractors, suppliers and counterparties across the project supply chain. |
| Embedded Consulting | A specialist placed inside the project team through the phases approaching energisation and COD. |
Frequently asked questions
What is the difference between PML, MFL and a worst case?
A PML estimates the loss arising from scenarios that are severe but reasonably plausible, taking existing controls, mitigation and recovery capacity into account. An MFL assumes those defences fail. A worst case is a theoretical construct with no plausibility constraint at all. The three answer different questions and are not interchangeable in a placement discussion — quoting one where the other is expected is a common source of misunderstanding between brokers and underwriters.
Which perils does the assessment cover?
Sabotage, terrorism, strikes, riot, civil commotion and malicious damage, together with the denial of access that can follow from them. We assess against the perils specifically listed in the cover being analysed rather than against the broad category of political violence, which we use to characterise the threat environment but never as a substitute for the contractual wording. Natural catastrophe modelling is a separate engineering discipline and falls outside our scope; where it matters to a project, we say so.
Can the assessment be done remotely?
Yes. A remote assessment works from the technical, commercial, insurance and operational documentation provided, complemented by working sessions with the designated project contacts. Where the threat environment, the construction stage or the concentration of value justifies it, we recommend a site visit as additional scope — but we say so on the merits of the project rather than by default.
What documentation do you need to start?
Technical descriptions, layouts and plans; information on substation, transmission and interconnection; the construction schedule and COD reference; the distribution of insured values; details of principal equipment, contracts and suppliers; and the insurance documentation, including issued policies and, where relevant, construction, cargo and delay covers together with placement slips. Gaps are not a blocker — they are recorded, and their effect on the conclusions is stated explicitly.
Why can a low-value asset drive the PML?
Because severity follows functional criticality, not price. A transformer or a substation bay may represent a small share of the works value while carrying replacement lead times long enough to move the commercial operation date by months. Once that happens, the delay exposure it generates can exceed the physical damage several times over. Assessments that weight assets by value alone consistently miss this.
Does the report confirm that our policy will respond?
No, and any report that claims to should be treated with caution. We contrast the modelled scenarios against the limits and sublimits actually placed, which frequently shows that a sublimit matters more than the aggregate. But whether a given loss is indemnified depends on the real event, causation, triggers, terms, conditions, exclusions, deductibles and waiting periods. That determination belongs to underwriters, adjusters and legal advisors, not to us.
How long does the assessment remain valid?
A PML is a dynamic assessment, not a certificate. Material changes to construction progress, interconnection configuration, the COD, insured values, long-lead items, protection measures, the threat environment or the insurance programme should each trigger a review of the assumptions. We identify those review points in the report so the client knows what should prompt an update rather than discovering it after the fact.
How quickly can you deliver?
Turnaround runs from complete documentation and the initial working session, not from the date of instruction — incomplete information is the single most common cause of delay. Give us the placement or lender deadline and the state of the documentation, and we will tell you what is realistic rather than what is convenient.
Contact us
Are you interested in the ACK3 Probable Maximum Loss (PML) Assessment services?
Get in touch with us by completing the form below: