Start with the license, since nothing else in the plan actually matters without it. An insurance company needs special permission from the government in every state where it wants to sell policies. Each state also decides how much money the company has to keep on hand, both before it gets approved, and continuously after.
The plan should clearly say where the company is based, what types of insurance it wants to sell, how long approval will take, and exactly how much money has to sit there, untouched, just to meet these rules. If this information comes first, right on page one, it shows the founder actually understands how this business works. If it's hidden behind marketing talk instead, it looks like the founder hasn't even talked to a regulator yet.
Next, the plan needs to separate the money customers pay for insurance from every other type of income. Ironvale's example keeps the same split every single month: 70% comes from customer premiums, 20% comes from investing money, 5% comes from money recovered on past claims, and 5% comes from other sources.
By Year 3, that means $299,000 comes from premiums, and $85,000, $21,000, and $21,000 come from the other three sources. Only that first number, premiums, actually comes from selling insurance itself.
The investment income comes from earning interest on customer money the company is holding onto, in the time between collecting it and eventually paying out claims. Recoveries are money the company gets back after paying out a claim, for example, if it turns out someone else was responsible for the damage.
A strong business plan for an insurance company should show these four sources of money separately, not blended into one number, since blending them hides whether the company actually makes money from selling insurance, or from investing money, which are two totally different businesses.
Third, the plan needs to clearly state the loss ratio, and explain why it makes sense. That one number, how much gets paid out in claims compared to how much comes in from premiums, really decides whether the whole business works or not.
In this example, claims start at 17.50% of revenue and rise to 20.00% by Year 3. Since premiums make up 70% of revenue, that works out to a loss ratio of about 25%, rising to about 29%.
That's a totally normal, safe number for most types of insurance. But it's actually surprising for cyber insurance specifically, where just one major hacking incident could easily wipe out an entire year's worth of customer payments.
A strong insurance company business plan should clearly explain how this number was calculated, based on real industry data, the coverage limits being offered, and what would happen if claims came in twice as high as expected. If this part of the plan is weak, nothing else in it can really be trusted, which is exactly why this kind of risk analysis belongs directly in the underwriting section, not buried in an appendix.
Fourth, the plan should treat reinsurance as a smart financial strategy, not just another expense. Reinsurance means an insurance company shares some of its risk with another, bigger insurance company. New insurance companies almost always want to insure more than they can actually afford to cover on their own, and sharing risk with a reinsurer lets that bigger company's finances help cover the volume the smaller company can't handle alone.
In this example, the company passes along about 8% of its revenue, roughly 11% of its premiums, to a reinsurer, while still keeping almost 90% of every cyber insurance policy it writes, all while only having $158,000 of its own money.
The plan should clearly explain this reinsurance agreement, how much risk is kept versus shared, and name the actual reinsurance companies involved, since that's really what a reviewer will judge the whole business against, not just how much revenue is expected.
Size the addressable market the way real market sizing discipline actually requires, and be clear that a valuation built on retained risk is only ever as solid as the reinsurance backing it up.