CPCU 550 cheat sheet

Data hierarchy: character/field → record → file/table → database → data warehouse; analytics maturity runs descriptive (what happened) → diagnostic (why) → predictive (what will happen) → prescriptive (what to do).

Structured data lives in defined rows and columns (policy, claims, billing tables); unstructured data includes text, images, audio, and PDFs, and requires extraction before analysis.

Data quality dimensions: accuracy, completeness, consistency, timeliness, validity, and uniqueness. A single defect can invalidate a predictive model, so profiling precedes modeling.

Data governance assigns ownership, stewardship, definitions, and access rights; a data dictionary or business glossary standardizes field meanings across systems of record.

Metadata is data about data (source, format, refresh date, ownership); lineage traces data from origin through transformation to report, supporting audit and regulatory review.

ETL extracts, transforms, and loads data into a warehouse; ELT loads raw data first and transforms inside the target platform, which suits cloud-scale stores.

The insurance data model separates policy administration, claims, underwriting, billing, and reinsurance; the policy and claims systems are the core systems of record.

Loss runs, exposure schedules, and third-party data (credit, geospatial, telematics, MVR) are external feeds that must be matched to internal identifiers before use.

Predictive model workflow: define target variable → assemble and clean data → feature engineering → split into training/validation/test sets → train → validate → deploy → monitor for drift.

Overfitting means the model memorizes training data and fails on new data; detect it when training performance greatly exceeds validation or test performance.

Supervised learning uses labeled outcomes (fraud/no fraud, claim cost); unsupervised learning finds structure without labels (clustering, anomaly detection); reinforcement learning learns from reward feedback.

GLM (generalized linear model) is the actuarial standard for frequency-severity pricing; it assumes a distribution (Poisson, gamma, Tweedie) and a link function relating predictors to expected loss.

Model lift and gain charts show how much better a model ranks risk than random selection; AUC measures discrimination, while calibration compares predicted to actual outcomes.

Explainability tools (feature importance, SHAP values, partial dependence) support rate filing justification and fair-lending or unfair-discrimination review of model inputs.

Model risk management requires documented development, independent validation, periodic review, and defined governance for override and retirement decisions.

Model drift occurs when the relationship between inputs and outcomes changes after deployment; monitoring compares live performance to development benchmarks and triggers recalibration.

AI in claims includes automated first notice of loss, damage estimation from photos, medical bill review, subrogation detection, and fraud scoring; human review remains for exceptions and adverse decisions.

Telematics and usage-based insurance price on mileage, braking, acceleration, and time of day; privacy rules and consent requirements govern collection and use of driving data.

Insurtech distribution models span direct-to-consumer digital platforms, embedded insurance at point of sale, and managing general agents operating on carrier paper.

Blockchain and smart contracts can automate parametric or trigger-based coverage; the ledger provides shared, tamper-evident records among insurer, broker, and reinsurer.

Robotic process automation handles repetitive rule-based tasks (policy issuance, endorsement entry); it does not learn, unlike machine learning.

Cloud computing shifts capital expense to operating expense and offers scalability, but requires due diligence on data residency, vendor concentration, and exit planning.

APIs let core systems exchange data with agents, comparison sites, and partners in real time; API security relies on authentication, rate limiting, and encryption.

Straight-through processing requires clean data and standardized rules so a submission is quoted, bound, and issued without manual rekeying.

Cybersecurity triad: confidentiality (access limited to authorized users), integrity (data unaltered and accurate), availability (systems accessible when needed).

Defense in depth layers controls: perimeter firewalls, network segmentation, endpoint protection, identity and access management, encryption, and monitoring.

Multi-factor authentication combines two or more of knowledge, possession, and inherence factors; it reduces risk from stolen credentials and is a common regulatory expectation.

Least privilege grants users only the access needed for their role; role-based access control maps permissions to job functions and is reviewed periodically.

Encryption protects data at rest (stored) and in transit (networked); key management determines who can decrypt and must be separated from data custody.

A ransomware event typically encrypts systems and demands payment; response relies on immutable backups, incident response plans, and notification to regulators and affected parties.

Breach notification laws require timely notice to regulators and individuals; state laws and sector rules differ on timing, thresholds, and content of notice.

Third-party risk management requires pre-contract security assessment, contractual security and notification clauses, and ongoing monitoring of vendors with data access.

Privacy principles: notice, choice/consent, purpose limitation, data minimization, retention limits, and individual access and correction rights.

The Fair Credit Reporting Act governs consumer reports used for underwriting and requires adverse action notice when a consumer report contributes to an unfavorable decision.

The Gramm-Leach-Bliley Act requires privacy notices and safeguards for nonpublic personal information; its Safeguards Rule obligates a written information security program.

HIPAA restricts use and disclosure of protected health information; insurers acting as covered entities or business associates must apply administrative, physical, and technical safeguards.

The NAIC Insurance Data Security Model Law requires licensees to maintain an information security program, investigate incidents, and notify the commissioner within stated timelines.

Big-data regulatory concerns include proxy discrimination, disparate impact, transparency of automated decisions, and whether new data sources are unfairly discriminatory or actuarially justified.

Records retention schedules must satisfy state insurance recordkeeping rules, litigation holds, and privacy deletion obligations; conflicts resolve in favor of the longer legal duty.

Data ownership questions arise with third-party vendors and insured data; contracts should state who owns derived data and how it is returned or destroyed at termination.