No governance code asks a board to test its insurance programme. The test already exists, written for someone else.

An article in the Financial Mail in July argued that the greatest governance risk is not the insurance programme a board deliberately approves, but the one it believes it has approved and does not fully understand.

We set out to test that. We found no governance standard, in any of four jurisdictions, that tells a board what it should have established before it approves one.

That is a narrower claim than it sounds: it is about what the codes actually say, not about whether boards are careless.

We traced the question through the codes themselves, not through commentary about them. Five instruments: the Code on Corporate Governance for South Africa 2025, King IV, the UK Corporate Governance Code and its internal-control guidance, the ASX Principles, and HM Treasury's Orange Book. We searched each for four words — insurance, insurer, insure, risk transfer. Then we read what prudential regulators require of insurers when those insurers buy reinsurance, and set the two side by side.

Across King V's thirteen principles, those four terms do not appear. The answer is none. The other codes return nothing of substance either: the ASX Principles mention insurance only in the commentary on directors' own indemnity, and the Orange Book describes risk sharing through commercial contracts without naming it. Yet four developed regimes already ask the right question — of insurers, in their capacity as buyers of reinsurance. Two accounting standard-setters reduce it to the same formulation: can the party said to be taking the risk actually lose money? On the public record, no regime anywhere asks that of a non-financial company.

Not a criticism of the codes

Principle-based codes do not enumerate risk responses, and they are not written to. Nor is it a story about South Africa lagging. On the public record South Africa is ahead of the comparators on three points. It restricts fronting by local insurers, although that restriction is expressly disapplied for global programmes of four or more jurisdictions. It caps explicitly how much one insurer may cede to a single reinsurer. And a statutory security architecture behind Lloyd's participation guarantees a South African forum and a South African pool of assets. The gap we found runs through all four jurisdictions, which is what makes it structural rather than local.

Two things surprised us

Our view, for what it is worth

The most useful finding is the encouraging one. Of the ten failure mechanisms we coded, nine are detectable before a loss. They sit in documents a board can ask for: a subjectivity register, a schedule of carriers, a governing-law clause, a claims-agreement threshold. Only the construction of a wording is genuinely undetectable in advance, because construing a wording is what a court does. That points at something less daunting than insurance expertise. It points at which documents reach the board, and in what order.

Those are questions, not advice. We are a research firm, not anyone's broker or counsel, and the answers belong to the board that asks them.

One caveat, plainly. This is desktop research from public sources, with an evidence date of 18 September 2026. Where we found nothing we have said we found nothing, which is not the same as saying nothing exists. If the public record misses something you know, we would like to hear it.