Insurance is one of the few industries that has been doing spatial risk assessment continuously for well over a century, long before there were geospatial APIs to do it with. The methods are old, the regulatory scrutiny is heavy, and the tolerance for a black box is close to zero. That combination makes it an unusually demanding consumer of open geospatial data, and an unusually good test of whether a scoring pipeline is honest.
The demand is real. Underwriting a property portfolio requires a view on every risk location, and buying that view commercially for every peril in every territory is expensive enough that the gaps get filled with assumptions. Open hazard maps, open elevation models, open building footprints, and open imagery derived layers can fill some of those gaps genuinely.
They can also produce something that looks like a risk score, sorts nicely, and means nothing. The difference is almost entirely in how the components are kept apart and how the result is explained.
What the underwriter is actually asking
A location score is not the question. The questions underneath it are more specific and they decompose differently.
Will this property be damaged by a defined peril within the policy period, and how badly. That is the loss question, and it is what a premium is priced against. It requires a frequency, a severity distribution, and something about what the building does when the peril arrives.
Is this risk correlated with the rest of the book. A single property that floods costs a claim. Two thousand properties that flood in the same event cost a solvency conversation. Correlation is a portfolio property and it is invisible in any single location score.
Can the claim be serviced. Access for loss adjusters, availability of contractors, time to restore. This is a cost driver and it is spatial, and it is routinely left out of models that concentrate on hazard.
Is the risk acceptable at any price, and if declined, on what stated basis. Declination has to be defensible, both to the broker and to a regulator, which means the reason has to be a reason and not a number.
A scoring system that treats all of these as one output will be argued with by the first underwriter who uses it, and correctly.
Hazard, exposure, vulnerability: three things that must not be merged
The oldest discipline in catastrophe modelling is keeping three concepts apart, and the most common failure in newer data pipelines is merging them.
Hazard is the physical phenomenon and its intensity, independent of anything humans put there. Depth of flooding at a given return period. Peak ground acceleration. Wind speed at a given exceedance probability. Hazard exists whether or not anything is at that location.
Exposure is what is there and what it is worth. The building, its footprint, its use, its replacement cost, the contents, the business interruption value. Exposure is an inventory, not a probability.
Vulnerability is the relationship between the two: given this intensity at this asset, what fraction of value is lost. This is the damage function, and it is a property of construction type, age, height, foundation, roof form, and code regime.
Multiply them and you get an expected loss. Conflate them and you get nonsense, in specific and predictable ways. A high hazard zone with nothing in it scores as high risk, which is meaningless for a portfolio. Two identical buildings in the same flood cell score identically even when one is a reinforced concrete frame with a raised ground floor and the other is unreinforced masonry at grade. A score built from hazard alone will rank a modern engineered structure in a moderate wind zone below a fragile structure in a mild one, which is backwards.
The practical rule is that the three components stay as separate fields in the data model all the way to the output, and any composite is computed at the point of use with the components still attached. The moment they are collapsed into one column, nobody downstream can tell whether a change in the score came from a new hazard map or a corrected building attribute, and the model becomes unmaintainable as well as unexplainable.
The layers, and what each one is actually good for
Open geospatial data supports some of these components far better than others.
- Hazard exposure. Flood hazard maps published by national agencies and regional programs, seismic hazard from public geological surveys, cyclone and wind climatology, wildfire fuel and history layers. Quality varies enormously by territory and peril. Where a national mapping program exists, it is usually the best available at any price. Where it does not, global models fill in with much coarser resolution and much weaker local calibration.
- Terrain. Open elevation models give ground height, slope, aspect, and derived measures such as height above nearest drainage. For pluvial and fluvial flood these are genuinely informative, and they are one of the few places where an open global layer is close to a commercial one. Resolution and vertical accuracy set the limit, and both matter more than they look: a one meter vertical error is a large fraction of a typical flood depth.
- Building characteristics. Footprint geometry from open building datasets, height where available, roof form from imagery, sometimes construction era inferred from surrounding development history. This is the weak link and it gets its own section below.
- Access and lifelines. Road network for adjuster access and for evacuation, distance to fire stations and hydrants, distance to hospitals, power and water network proximity where published. These feed claim servicing cost and, for some perils, the loss itself.
- Surrounding density and land cover. Built up fraction for conflagration and wildfire interface, vegetation proximity, distance to coast, distance to watercourse, industrial land use nearby for contamination and secondary perils.
Two cautions on layer use. Return period hazard maps are not additive across perils and cannot be averaged into a general hazard index without destroying their meaning. And a hazard layer with a stated resolution of thirty meters does not know which side of a street a building is on, which is exactly the distinction that decides flood outcomes.
Building attributes are the weak link, and pretending otherwise is the main risk
Vulnerability needs construction type, age, number of stories, first floor elevation, roof covering, and code regime. Open data rarely has any of them.
Footprints are widely available. Heights are available in some places from stereo imagery or lidar derived surface models, and where available they are useful for story count with assumptions about floor to floor height that are themselves regional. Roof form and material can be estimated from aerial imagery with reasonable accuracy in some conditions. Construction type and age are the two that matter most for damage functions and they are the two that essentially never appear.
There are proxies, and they should be treated as weak. Neighborhood development era from historical imagery gives a construction period distribution, not a building age. Building size and form give a hint about construction system. Local building stock studies, where published, give a regional mix that can be applied as a prior. Each of these produces a distribution rather than an attribute, and each one is far less informative than the single field it replaces.
The honest handling is to carry the vulnerability input as a distribution with an explicit uncertainty and to propagate that uncertainty into the loss estimate, rather than picking the modal construction type and proceeding as if it were known. The output changes character when this is done properly. Instead of an expected loss it becomes an expected loss with a wide interval, and the width of that interval is itself a decision input: a risk with a narrow interval can be priced, a risk with a very wide interval needs a survey.
The failure mode to avoid is the default. Assign every unknown building the regional average construction, and the portfolio becomes uniformly average, systematically understating both the best and the worst risks. Averages are safe for an aggregate and misleading for every individual location in it.
Single risk and accumulation are different products
A single risk assessment answers whether to write this property and at what price. An accumulation assessment answers what happens to the whole book when one event occurs. They use overlapping data and almost nothing else.
Accumulation is a spatial correlation problem. The relevant unit is not the property, it is the event footprint: the area covered by one storm, one flood, one earthquake rupture. What matters is how much total insured value falls inside plausible footprints, and how much of the book is exposed to the same footprint at once. A model that scores each location independently and then sums the scores answers the wrong question completely, because independent summation destroys exactly the correlation being asked about.
Practically this means the pipeline needs the ability to intersect the portfolio with event footprints, real or simulated, rather than only with static hazard grids. It also means geocoding quality becomes a first order concern in a way it is not for single risk. A property placed at a street centroid instead of its actual parcel might be a small error for pricing and a large error for accumulation, because zone boundaries and event footprint edges are where the aggregation flips.
Zone based accumulation control, counting insured value inside administrative or postcode zones, is still common because it is simple and auditable. It inherits the boundary problem: the zone was drawn for postal delivery, not for the physics of a flood, and risk concentrations that straddle a boundary are undercounted in both zones.
Model risk and the expectation of explanation
Insurance regulators expect a firm to understand the models it uses to price risk and hold capital. The specifics differ by jurisdiction, and the general expectation is consistent: documented assumptions, validation against experience, understanding of limitations, and governance over changes. A vendor model that cannot be interrogated is a model risk finding, not a competitive advantage.
That shapes what an acceptable output looks like. A score has to arrive with its contributions: which layers moved it, by how much, with what data vintage, and what was unknown. It has to be reproducible, meaning the same input on the same date yields the same output, which requires versioning of every input layer rather than silently querying whatever is current. And changes have to be attributable, so that when a book reprices after a data update, the firm can state which layer changed and what it did.
The same requirement arrives from a different direction through fairness and conduct rules. A model that declines risks or loads premiums in a way that correlates with protected characteristics is a problem regardless of whether any protected characteristic was an input, and geographic variables are frequently good proxies for demographic ones. That is not an argument against spatial models. It is an argument for being able to decompose a decision and demonstrate which physical variable drove it, which is impossible if the score is a single opaque number.
What an acceptable output looks like
A usable location assessment, in practice, is a document rather than a number.
- Per peril, the hazard intensity at defined return periods, with the source layer, its resolution, and its vintage.
- The exposure record used, including how the location was geocoded, at what precision, and with what confidence.
- The vulnerability inputs, each labelled as observed, inferred, or defaulted, with the source of the inference.
- A loss estimate with an interval, and a statement of which unknowns dominate the interval.
- A coverage figure: what proportion of the model inputs were populated from real data for this location.
- The list of what was not evaluated at all, because a peril with no available hazard layer in this territory is not a zero risk peril.
The last two items are what separate a model from a guess with a user interface. A location that scores low risk on four of nine perils, with the other five unevaluated because no data exists in that territory, is not a low risk location. It is an unassessed one, and any system that renders it as a green dot is manufacturing confidence it does not have.
Where open data genuinely wins
None of the above should be read as a case against using open geospatial data in underwriting. There are places where it is straightforwardly the best option.
Terrain derived flood indicators in territories without a national flood map. Building footprint counts and built up area for exposure sanity checking against a submitted schedule of values, which catches data entry errors that would otherwise price a risk badly. Change detection between imagery dates for confirming that a declared new build actually exists. Access and lifeline distances for claim cost estimation, which commercial catastrophe models generally do not provide. And portfolio level screening, where the goal is to find the locations that need a human look rather than to price each one.
That last use is the one with the best ratio of value to risk. Open data is often good enough to rank and triage, and rarely good enough to price without review. Building the system as a triage tool that surfaces the top of a queue, with its reasons attached, delivers most of the benefit and avoids the failure where a thin model silently sets a premium.
The score is the least useful part
A risk score without its contributions is a rumor with a decimal point. It cannot be validated, because there is nothing to check it against component by component. It cannot be corrected, because when it is wrong there is no way to find which input was wrong. It cannot be defended in a regulatory review, because the answer to why was the premium loaded cannot be the model said so. And it cannot be improved, because there is no way to measure whether a new data layer helped.
The correct order of construction is inverted from the way these systems usually get built. Build the components, expose them, let underwriters use them individually, and only then offer a composite as a convenience on top. A composite built first and decomposed later is almost never decomposable, because the decisions that destroyed the decomposition were made early and cheaply, in the code that filled a missing value with a default and moved on.