Incoverage

Incoverage is a term used in risk management and insurance discourse to denote the share of a risk that is mitigated or protected by an organization's internal resources and controls as opposed to protections provided by external sources such as insurance policies, vendor risk transfer, or contractual protections. The concept is typically described as a ratio or percentage representing how much of the total risk mitigation is in-house. The term is an emerging concept and does not have a universally codified definition across industries.

Practitioners define internal coverage as the sum of controls, processes, personnel, and technologies that directly reduce risk, without relying on external coverage. Total coverage includes internal measures plus external protections. Internal coverage is often expressed as a percentage: internal mitigations divided by total mitigations. Data inputs include control inventories, effectiveness assessments, and insurance or outsourcing arrangements.

Incoverage is used in enterprise risk management, cyber risk governance, supply chain resilience planning, and financial risk assessment to help executives understand reliance on internal versus external protections and to inform decisions about investing in additional controls or insurance.

For example, a company facing data breach risk may deploy internal measures such as access controls and anomaly detection and also purchase cyber liability insurance. If these internal controls constitute 70% of the mitigations needed to reach target risk levels, the incoverage would be expressed as 70%.

Because there is no standard definition, incoverage risks inconsistent interpretation across organizations. Critics note the concept can obscure residual risk if external protections are undervalued. It is often discussed alongside terms such as risk coverage, residual risk, internal controls, risk transfer, and insurance.