A reserve range you can reproduce to the digit.

Loss reserving with four methods and a reproducible bootstraplink

Chain ladder, Bornhuetter-Ferguson, Cape Cod and ELR on one triangle, with Mack and a seeded bootstrap for the range.

One triangle, four deterministic methods. Chain ladder develops the paid or reported triangle on volume-weighted link ratios; Bornhuetter-Ferguson blends the development estimate with an a-priori loss ratio by the proportion still undeveloped; Cape Cod derives that a-priori from the data itself rather than taking it as an input; and the expected-loss-ratio method holds it fixed. Running them side by side is the point — the spread between them is the actuary's first read on how much the answer depends on the method.

The range comes from two stochastic methods with different assumptions. Mack gives an analytic standard error on the chain-ladder estimate without simulating anything. The bootstrap resamples residuals to build a full predictive distribution, and it is SEEDED — the same triangle and the same seed reproduce the same percentiles exactly. A stochastic reserve range you cannot reproduce is not evidence, and reproducibility here is a property of the implementation rather than a process someone follows.

Tail development is fitted rather than assumed: a tail factor is estimated from the observed link ratios and applied beyond the triangle, so the ultimate does not quietly stop at the last development period the data happens to reach.

Paid and incurred are reconciled rather than selected between. Run classical chain ladder on each triangle in isolation and one book has two ultimates — the reserve then depends on which triangle somebody chose. Munich chain ladder uses the correlation between them, informing each triangle by the other's residuals so the two estimates converge instead of being averaged by hand and called a selection. It narrows the gap and does not close it, and the residual gap is reported: a method producing exact agreement would be hiding the disagreement rather than resolving it. Where the fitted lambdas are near zero Munich collapses back to plain chain ladder, which is the engine saying the method has nothing to add here.

Segment experience is believed in proportion to its exposure. Bühlmann-Straub credibility weights a segment's own loss ratio against the portfolio mean, so a small book cannot price itself on three volatile years — a segment swinging by a factor of four between years is telling you about its size rather than its risk. The weight is applied whether or not the answer it produces is the one the segment's owner wanted.

IFRS 17 measurement and CSM roll-forwardlink

GMM, VFA and PAA with a contractual service margin that rolls forward rather than being restated.

IFRS 17 is implemented as measurement models rather than a disclosure template laid over existing numbers. The general measurement model, the variable fee approach for contracts with direct participation features, and the premium allocation approach for short-duration business each compute their own liability, and which applies is a property of the portfolio rather than a reporting choice made later.

The contractual service margin rolls forward: opening balance, interest accreted, new business, changes in fulfilment cash flows relating to future service, release for services provided in the period, closing balance. Rolling forward rather than recomputing is what makes period-on-period movement explicable — an auditor asks why the CSM moved, and a roll-forward answers it line by line where a restatement does not.

The risk adjustment for non-financial risk sits alongside the fulfilment cash flows, and the loss component on onerous contracts is tracked separately from the CSM, because a group that is onerous does not have a CSM to release.

Solvency II SCR and NAIC RBClink

Regulatory capital computed on both regimes from the same book.

The solvency capital requirement is computed by module — market, life, non-life, health, counterparty default and operational — and aggregated through the prescribed correlation structure rather than summed. Aggregation matters more than any single module: summing SCRs ignores diversification and overstates the requirement, which is why the correlation matrix is part of the calculation rather than a footnote.

Lapse risk is computed as the worst of mass lapse, permanent increase and permanent decrease, which is the shape the standard formula actually prescribes — the worst case rather than a central estimate.

NAIC risk-based capital runs on the same book for US entities, so a group operating under both regimes reads two regulatory answers from one set of figures rather than maintaining two data preparations that drift.

Mortality, lapse and experience studieslink

Actual-versus-expected against real tables, with credibility applied rather than assumed.

Mortality runs from real tables with interpolation between age nodes and separate smoker and non-smoker bases, so a rate at an intermediate age is derived rather than rounded to the nearest published row. Table ratings and flat extras apply on top, which is the structure a life pricing or valuation basis actually uses.

Experience studies compare actual to expected over an exposure period and apply credibility to the result — because a small exposure producing a striking A/E ratio is usually telling you about the exposure rather than the mortality. Applying credibility is what separates an experience study from a ratio.

Lapse and persistency studies run on the same machinery, and the resulting assumptions feed pricing and valuation from one place rather than being re-entered into each.

Assumption sets, versioned and approvedlink

Assumptions are versioned records with lineage, so a run can be tied to the basis it used.

Assumptions live as versioned sets rather than as values inside a model. A set carries its own identity and approval state, and a run records which set it used — so the question every valuation review asks, "what basis produced this number", is answered by the run rather than reconstructed from a change log.

Because the set is versioned rather than edited, a superseded basis remains readable. A run records the version identifier rather than the table name, so publishing a new discount curve does not change last quarter's answer. Reproducing a prior period means pointing at the set that was in force, not restoring a backup.

Approval is separated from authorship: the platform rejects an approval by the author of the basis rather than warning about it. And the control sits on what may be PUBLISHED rather than on what may be computed — a projection pinned to an unapproved assumption version runs, and is marked not reportable. Blocking analysis on unapproved assumptions would stop actuaries doing the exploratory work that produces the approved basis in the first place, so the refusal lands where it belongs.

This is the same discipline the rate book uses on the underwriting side, and deliberately so: a number that cannot be tied to the assumptions behind it is not reproducible, whatever else is stored with it. Model definitions are held the same way — a validator returns every diagnostic with the path it came from in one pass rather than stopping at the first failure, a definition that fails validation is still saved because authors need drafts, and publishing re-validates against the assumption tables that exist at that moment.

Filings with hashed evidence packslink

A filing ships with a SHA-256 hashed pack, so the evidence submitted is identifiable afterwards.

Regulatory filings assemble an evidence pack and hash it with SHA-256. The hash is the point: it makes the exact set of figures and documents submitted identifiable later, which is what a follow-up question from a regulator months afterwards actually needs.

Peer review and appointed-actuary sign-off are recorded against the work rather than tracked outside it, so the governance trail and the numbers are the same record.

The filing types the platform recognises span Solvency II, IFRS 17, NAIC rate filings, market conduct, RBC, LDTI and APRA — as filing categories. That is a routing and packaging capability, and it is worth being precise: recognising LDTI as a filing type is not the same as implementing LDTI measurement.

P&C pricing and catastrophe modellinglink

On-level, trend, frequency-severity and credibility for pricing; accumulation-based PML for cat.

P&C pricing runs the standard chain: bring historical premium on-level to current rates, trend losses to the pricing period, fit frequency and severity separately rather than modelling pure premium as one quantity, and apply credibility to the indicated rate change.

Separating frequency from severity matters because they move for different reasons and respond to different actions — a severity trend driven by repair costs and a frequency trend driven by exposure are the same indicated rate change and completely different problems.

Catastrophe modelling works from real accumulations rather than a static PML figure: exposure is aggregated by zone and the probable maximum loss is derived from that accumulation, so a change in the book moves the number.

The certified-data gatelink

No production run uses uncertified source data unless the run is labelled exploratory — and an exploratory run can never be published.

Certification is a DECISION, not a score. A data-quality run measures what the rows look like — how many errors, whether control totals tie — and it is produced by code. A certification is a named person saying "this version may back a production actuarial result", on the strength of that measurement. Collapsing the two is how this control usually rots, so they are separate records and only the second opens the gate.

Effective status is derived at decision time rather than read from a stored column. The dataset-versions table caches a status so that listing versions is one query, and the gate deliberately ignores that cache: a cache is written when the decision is made and cannot know when a validity window later closes. Where no expiry was stated, a default 90-day window applies — finite by design, so nothing is ever certified forever. A withdrawal stays visible as `revoked` rather than being softened back to "nobody has looked at this yet", and any decision value the gate does not recognise blocks rather than falling through a default branch.

An override is the only way past an uncertified version, and it is matched exactly. Purpose is compared for equality against a closed set of eleven work types, so a waiver obtained to unblock a pricing study cannot authorise a reserve close; a scoped override authorises only its own project. The decision names the override it relied on, so a close run on certified data and a close run on a waiver are distinguishable afterwards rather than both reading "allowed". The other route past the gate is the exploratory label, and it is not free: an exploratory run may read uncertified data and can never be published or approved, enforced by a database trigger rather than by the route that sets the label. Without that second half, "exploratory" would be a one-word bypass of the whole control.

Where the gate reaches is a list you can read rather than a claim. Eleven work types each have their own provenance resolver, because "which dataset versions does this run depend on?" has a different answer for reserving, pricing and training. Twenty-one agent actions are gated at the executor dispatch point — before the executor is called, so a refused step genuinely did not compute — plus the reserving close, the reserving run and the pricing run routes. Work whose provenance does not reach a dataset version is counted and reported rather than blocked, because there is nothing there to certify; that limitation travels with the decision, since a gate that finds nothing to check and answers "cleared" is indistinguishable from one that checked.

Sealed evidence packs a reviewer can check without uslink

Eighteen sections, a limitations list built from what the run could not establish, and a seal anyone holding the pack can verify.

A workflow evidence pack assembles a completed run into eighteen sections — source data versions, certification results, reconciliations, model and assumption versions, run parameters, output, diagnostics, sensitivities, movement analysis, recommendations, review comments, approvals, limitations, citations, generated reports and export history. Which section a step's output belongs to is DECLARED on each of the 219 capabilities rather than inferred from the step, so a new agent action cannot silently fail to appear in the evidence.

The limitations section is assembled from what the run could not establish: the steps that ran and found no data, the steps with no executor bound, the steps held for approval and never run. Nobody composes it. It is the section a reviewer needs most and the one a system is most tempted to leave flattering, which is exactly why it is derived rather than written. An empty section states which of three reasons applies — nothing feeds it, its feeding steps found no data, or they did not complete — because "we looked and there is none" and "we did not look" are different findings and a reader must not have to guess.

Immutability is enforced twice. A BEFORE UPDATE and BEFORE DELETE trigger prevents a sealed pack from being altered in the database at all, and a SHA-256 digest over a canonical serialisation of the content detects it if it were. Corrections supersede into a new version; a sealed pack is never edited. The digest is deliberately computed in plain TypeScript rather than through a Node built-in, so a reviewer holding the pack can verify the seal themselves — a seal only the issuing system can check is a claim about the issuing system rather than evidence. The hash covers content and excludes who exported it and when, so two people can confirm they are holding the same pack.

Where this module ends todaylink

Stated rather than implied: the capital lab, PBR and the model-drift monitor are not built, and a pack exports as JSON.

This is the deepest module in the platform, which makes the few overclaims worth naming precisely rather than leaving among things that are true.

The capital module implements NAIC RBC and nothing else — there is no capital lab, no efficient frontier and no 50,000-simulation stress run. The page carried "50k stress simulations per capital run" as its headline metric and no such number exists anywhere in the engine. The genuine stochastic capability is the reserving bootstrap, which defaults to 500 iterations and is bounded at 5,000.

PBR and VM-20 are not implemented; LDTI exists as a filing category, not as a measurement model, and the page previously listed both alongside IFRS 17 and Solvency II as though they were peers. There is also no model-drift monitoring and no "AI time-to-breach" for actuarial models — those words appear nowhere in the codebase.

On the governance layer specifically: a sealed evidence pack exports as JSON, and there is no PDF or XLSX rendering of one. Compute runs synchronously behind hard input caps rather than on a job queue. And the certified-data gate rests on dataset versions and life-valuation model point versions — work whose provenance reaches neither is reported as unresolved rather than blocked, which is stated on every decision the gate makes.