By Min Hung Cheng
23 July 2026
When faced with a complex risk issue, we often say that we should “go back to first principles.”
It is easy to agree with this advice. It is much harder to practise.
Climate risk is rarely only a climate issue. It is also a health issue, an infrastructure issue, a food security issue, a fiscal issue, a household resilience issue, and an insurance issue.
Cyber risk is rarely only a technology issue. It is also an SME continuity issue, a trust issue, a financial stability issue, a governance issue, and increasingly, an insurability issue.
Health risk is not only about healthcare delivery. It is also about household finances, labour productivity, social protection, ageing, and public expenditure.
The difficulty with these risks is not only that they are technically complicated. It is that they are cognitively and institutionally complicated. Each actor sees the part of the problem closest to its own mandate. Insurers may see low insurance penetration. Regulators may see market conduct, prudential soundness, or enabling regulation. Finance ministries may see contingent liabilities and fiscal exposure. Health ministries may see access, affordability, and service delivery. Disaster agencies may see preparedness and response. Development partners may see poverty, vulnerability, and the Sustainable Development Goals.
Each perspective may be valid. None is complete.
This is why first-principles thinking matters. Before asking what product to launch, what risk pool to create, what subsidy to provide, or what regulation to amend, the more basic questions need to be asked. What harm are we trying to prevent or reduce? Who is exposed? What is the gap between total loss and available protection? What can be reduced before the event occurs? What can be transferred, pooled, or insured? What remains with households, communities, firms, or governments? Who has the ability and authority to act? How would we know whether resilience has actually improved?
These questions sound simple. But in practice, some of them are sometimes skipped.
The role of a framework
A framework should not be mistaken for an answer. It does not remove the need for judgment, evidence, local knowledge, political authority, financing, or implementation capacity. Used badly, any framework can become a checklist. Used well, it can slow down premature conclusions and create a better sequence of inquiry.
This is one way to understand the GAIP Integrated Protection Gaps Framework. Its value is not that it offers a ready-made answer to every protection gap. Its value lies in providing a disciplined route through the questions.
The framework appears straightforward. Step 0 aligns motivations and frames the problem. Step A understands and quantifies key risks. Step B identifies public-sector partners, stakeholders, and target groups. Step C develops the solutions menu. Step D develops the implementation plan, including mandates, governance, KPIs, and reporting.
At first glance, this may look almost obvious. Understand the problem, identify the actors, consider solutions, and implement them. But this apparent simplicity is the result of distillation. Protection gaps involve households, communities, governments, markets, public finances, regulation, trust, data, and risk behaviour. Without structure, all of that complexity can become noise.
Protection gaps are not merely insurance shortfalls. They are connected to fiscal resilience, poverty, climate resilience, access to health care, gender outcomes, food security, agricultural productivity, access to finance, the social role and stability of the insurance sector, and progress in economic development.
That is why the framework begins before solutions. It begins with motivation and problem framing. “Reducing protection gaps” may speak naturally to insurance experts, but vulnerability, fiscal exposure, social protection, efficiency, gender equity, resilience, and development outcomes may speak more directly to other policymakers.
This is first-principles thinking in institutional form. It asks not only “how do we increase insurance penetration?” but “why does the gap matter, to whom, and which wider public policy objectives are being undermined because the gap remains?”
Applying first principles to different risks
The usefulness of a first-principles structure is that it is not confined to one peril.
Consider climate risk. A narrow conversation may move quickly to rising premiums, affordability concerns, catastrophe modelling, disaster pools, or resilience investment. All of these may be relevant. But they are not the starting point.
The first-principles questions are more basic. What climate-related harms are being created or intensified? Which households, firms, assets, livelihoods, and public budgets are exposed? Which risks can be reduced through adaptation, infrastructure, land-use planning, nature-based solutions, early warning systems, or building standards? Which residual risks can be insured or pooled? What remains as sovereign fiscal exposure? Which actors must be involved?
This matters because climate risks cascade. Heavy rain may lead not only to flooding, but also to landslides, crop damage, waterborne disease, soil erosion, infrastructure damage, transport disruption, business interruption, food supply disruption, and livelihood loss.
A narrow solution may miss these interactions. A first-principles approach makes them visible.
The same logic can be applied to health, mortality, retirement, agriculture, natural catastrophe, cyber or AI, or other emerging risks. The framework does not decide the answer in advance. It provides a way of working through the issue without jumping too quickly to the most familiar solution.
Why the three solution groups matter
One of the disciplines in the GAIP framework is that it does not start and end with insurance.
It organises solutions around three interrelated areas: risk reduction, increased insurance penetration, and sovereign risk financing.
Risk reduction asks what can be prevented, avoided, mitigated, or made less severe. Insurance penetration asks how households, firms, communities, and institutions can access risk transfer that is useful, affordable, trusted, and relevant. Sovereign risk financing asks what remains with the government and how that exposure should be financed, preferably before the event rather than after.
The important point is that these are not separate boxes. They interact. Risk reduction can make insurance more available and affordable. Insurance pricing and underwriting can incentivise risk mitigation. Claims payments can support faster recovery. Ex-ante fiscal financing can reduce budget shock and improve response. Public-private partnerships may be needed when the private market cannot bear the risk alone.
This is where simple frameworks can be useful. They do not make the problem simple. They prevent the problem from being reduced to only one part of itself.
The discipline of not choosing too early
Complex problems often create pressure to act quickly. That is understandable. But speed can also lead to premature narrowing.
A ministry may select the solution it can fund. A regulator may select the solution within its mandate. An insurer may select the solution closest to its product capabilities. A development partner may select the solution aligned with its programme priorities. These choices are all reasonable, but they may also exclude more optimal combinations.
The GAIP framework tries to delay that narrowing. Step A asks for a broad view of risks. Step B asks who must be involved. Step C asks for a solutions menu rather than a single preferred answer. Step D asks how implementation will actually be governed and measured.
This is not indecision. It is disciplined sequencing.
The same logic applies to cost-benefit analysis. If cost-benefit analysis is used only after a solution has already been selected, it becomes a justification tool. If it is used earlier and more broadly, it becomes a choice tool.
That distinction is important. It pushes decision-makers to consider not only the most visible benefits but also secondary benefits, fiscal effects, risk reduction effects, insurance effects, broader economic outcomes, and impacts on target groups.
Simple because it has to be
The apparent simplicity of the GAIP framework should not be mistaken for ease.
Simple frameworks matter because complex systems need usable entry points. If a framework is too abstract, it does not guide action. If it is too detailed, it becomes unusable. The challenge is to preserve enough complexity to remain truthful while creating enough structure to enable action.
The practical lesson is modest but important.
When faced with a complex risk, do not begin with the solution most familiar to your institution. Begin with the harm. Then ask who is exposed, why the gap exists, what can be reduced, what can be transferred, what remains, who must act, and how progress will be measured.
That is going back to first principles.
And in a world where risks are becoming more interconnected, that discipline may matter as much as any single solution.
