Total Cost of Risk Ownership

White Paper · June 2026 · Co-developed with a global digital energy and building services company and a global commercial insurance company.

Executive Summary

Most institutional real estate owners are managing the wrong number. The figure they track, debate at renewal, and report to the board is Cost of Risk: claims, premiums, deductibles, the costs an insurer can see. It was never built to measure what risk costs the portfolio. For most institutional owners, the costs it misses are larger than the costs it measures.

That gap is not an accounting footnote. It is the difference between a portfolio that prices, plans, and defends its capital with confidence and one that absorbs surprise after surprise and calls it the cost of doing business. Every $1 of unplanned equipment failure carries $4 to $7 of total impact once downtime, emergency labor, tenant disruption, and insurance consequences are counted. The portion that shows up in a risk report is the smallest part of the bill.

Every $1 of unplanned equipment failure carries $4 to $7 of total impact. The portion that shows up in a risk report is the smallest part of the bill.

Total Cost of Risk Ownership, or TCRO, closes that gap. TCRO is a financial standard, not an insurance construct. It measures the full burden of risk across a portfolio, including the operational, capital, compliance, and reputational costs that traditional Cost of Risk leaves out. Once a portfolio can see the full number, two things become possible that were not before. Leaders can manage risk as a financial line item they control rather than a hazard they endure. And the operational data that produces the number, today a stranded asset sitting idle in disconnected systems, becomes a measurable financial asset.

This is the connection most owners miss. The same continuous data that makes failure predictable also makes risk priceable, capital plannable, and insurance defensible. It is the raw material of a lower TCRO and a new source of value. Treated as exhaust, it costs money to store and protects no one. Treated as an asset, it reduces risk-related costs, strengthens insurance positioning, and supports asset value.

This paper makes the case for TCRO as the standard institutional owners should adopt, explains the framework and its components, and shows how measuring TCRO converts building data into financial returns. The evidence is drawn from real portfolios and grounded in 20 years of claims experience, not assumptions. The organizations that adopt this standard first will plan capital more accurately, negotiate insurance from a position of evidence, and protect both the people inside their buildings and the capital behind them.

Key Findings

The Problem Is Structural, Not Occasional

Institutional real estate owners are not failing at risk management because they are careless. They are working from a number that was designed for a narrower world.

Traditional Cost of Risk emerged from the insurance industry to answer an insurer's question: what does it cost to transfer and settle the losses we can see. It captures claims and deductibles, premiums and retentions, loss adjustment expenses, and basic risk control spend. Aggregated, those figures represent the cost of managing insurable risk. For an underwriter, that is the right boundary.

For the owner of a multi-asset portfolio, that boundary leaves most of the cost off the page. Cost of Risk does not see the revenue lost when a chiller fails during peak occupancy. It does not see the premium an owner pays to mobilize an emergency crew at midnight instead of scheduling the same repair at standard rates. It does not see the capital misallocated when replacement decisions are driven by an asset's age rather than its actual condition. It does not see the audit and compliance overhead, the manual reconciliation across disconnected systems, or the reputational cost when a failure becomes a public event. These costs are real, they are recurring, and they are invisible to the one number most owners track.

Three forces are widening the gap and removing the option to ignore it.

Insurance markets have tightened, particularly for asset classes with complex mechanical systems, high occupancy density, or elevated life-safety exposure. Capacity is more selective and pricing is less forgiving of portfolios that cannot demonstrate control.

Emergency repair costs have risen sharply with labor and supply chain constraints, so the penalty for reacting instead of predicting has grown. The same failure costs more to fix unplanned today than it did five years ago.

Scrutiny has intensified. Boards, lenders, and insurers are asking harder questions about the operational discipline behind net operating income, and they increasingly want evidence rather than assurances. Yet only a minority of organizations describe their enterprise risk oversight as mature or robust, even among billion-dollar enterprises. Most still rely on periodic inspections, lagging reports, and post-event analysis.

The result is a portfolio that learns what its signals meant after the failure, not before. The gap between what a portfolio knows and what it acts on has become a material financial risk.

From Cost of Risk to Total Cost of Risk Ownership

The shift from Cost of Risk to TCRO is not a refinement of the same idea. It is a change in what the number is for.

Cost of Risk measures what happened and what it cost to transfer. It is backward looking and insurer defined. TCRO measures what risk costs the owner across its full lifecycle — direct and indirect, insured and uninsured, operational and strategic. It is forward looking and finance defined. Cost of Risk answers a transactional question at renewal. TCRO answers a strategic question every quarter: where is risk costing us, by how much, and what would it take to reduce it.

For most institutional portfolios, the TCRO column is not marginally larger than Cost of Risk. It is several times larger. That is the entire point of adopting the standard. An owner cannot manage, price, or reduce a cost the prevailing model cannot see.

TCRO is also vendor neutral. It is a financial standard any institutional owner can apply to understand the true burden of risk in a portfolio. Adopting the standard does not require any single platform. Acting on it at scale — turning a one-time estimate into a continuous, defensible measurement — does require continuous data. That is the role of a Digital Risk Platform, and it is where the second half of the value, data monetization, begins.

The TCRO Framework

TCRO becomes operational through a structured framework that turns scattered operational signals into a single, financially meaningful measure of risk. The framework rests on three moves: account for the full cost, build a common data environment that can measure it continuously, and run a disciplined process that converts measurement into action.

What TCRO accounts for

A complete TCRO measurement spans five cost categories. Naming them is what separates a financial standard from an insurance line item:

• Direct losses and claims — what insurers see and pay.
• Operational losses — downtime, emergency repair premiums, tenant disruption, lost revenue.
• Capital inefficiency — misallocated replacement spend, premature retirements, missed life extension.
• Compliance and governance overhead — audits, manual reconciliation, fragmented reporting.
• Reputational and strategic cost — tenant churn, public incidents, refinancing friction.

Quantified consistently, these costs can be normalized, benchmarked, and tracked over time and against peers. That is what makes TCRO a management tool rather than a one-time diagnostic. A number you can trend is a number you can manage.

The common data environment

TCRO is only as good as the data beneath it. The framework depends on a common data environment that brings three sources together: real-time monitoring of critical systems and environmental conditions, normalized historical claims and equipment data, and the asset inventory that ties signals to specific equipment, age, condition, and replacement cost.

This is where reliability is earned. Novem Digital's predictive models are trained on more than 20 years of claims data from 7.2M buildings across 103 equipment categories. That foundation connects a live condition signal to the financial outcomes that signal has historically produced. Risk reduction is grounded in real loss experience, not estimates.

The process that creates control

Once the data environment exists, TCRO runs as a continuous process rather than an annual exercise. A disciplined sequence moves a portfolio from identifying risk to controlling its cost: identify, assess, document the interrelationships between risks, measure in real time, predict, prevent, monitor, and control. The output is a living risk register that is continuously updated and tied to financial consequence — not a static spreadsheet refreshed once a year for the board. The first four steps establish what is at risk and what it would cost. The data platform enables the next four — the steps that reduce TCRO — by making prediction and prevention possible at portfolio scale.

The Financial Case for a CFO

For a finance leader, TCRO is not a risk philosophy. It is a lever on four numbers the board already watches.

Risk-related costs. TCRO surfaces the full cost base, which means it surfaces the full opportunity to reduce it. The savings are not theoretical. A boutique independent seniors living developer in British Columbia reduced insurance costs by 10% across Course of Construction, Wrap-Up Liability, and post-occupancy programs by engineering risk with continuous data instead of absorbing it. Those savings fell directly to the bottom line without compromising safety or coverage.

Capital planning. Most replacement decisions are driven by an asset's age, because age is the only data most owners have. Age is a poor predictor of failure. Live condition data lets owners replace equipment when condition warrants, not when the schedule assumes — which improves the return on every capital dollar and removes the emergency premium that comes with reacting late. Predictable capital planning replaces budget-destroying surprises with scheduled, standard-rate work.

Insurance and asset value. A portfolio that can demonstrate continuous, predictive risk management is a different underwriting proposition than one that can only report what failed. The market prices on demonstrated exposure, not stated intention. One customer maintained 0% annual insurance premium growth on a complex aging asset portfolio by showing underwriters continuous evidence of control. Lower, more stable risk-related costs support EBITDA, and a portfolio with a defensible risk story supports stronger asset valuations.

EBITDA protection. Every avoided emergency repair, every prevented claim, every stabilized premium is margin that stays in the business. A single vibration alert on aging ice-making equipment at a major events and entertainment campus in British Columbia prevented a maximum probable $5M insurance claim, and the same deployment recovered more than $400,000 per year in previously undetected natural gas costs. These are not soft benefits. They are line items.

The throughline is control. TCRO turns risk from a hazard a CFO endures into a cost a CFO manages, with audit-ready data behind every decision that a board, lender, or insurer will accept as evidence.

Make Data Pay: TCRO as the On-Ramp to Data Monetization

Here is the part most owners have not yet connected. The data that lowers TCRO is the same data that can generate value on its own.

Any asset is meant to appreciate and generate returns. Data is among the most valuable assets an organization owns, yet in most portfolios it sits as a stranded asset: generated continuously, stored at cost, and used for nothing. This is happening while the broader digital economy, which includes data sharing, contributes trillions to GDP and grows faster than the economy. The raw material of that value is already being produced inside every instrumented building.

Measuring TCRO is what activates it. To produce a defensible TCRO number, a portfolio must aggregate, normalize, and enrich its operational data inside a common data environment. Once that data is structured and trustworthy, it becomes monetizable in concrete ways.

It reduces cost, which is the first and most reliable form of return. Predictive and preventative insight avoids hidden costs, increases return on assets, and improves operational productivity.

It improves insurance economics for every party. Continuous, verifiable risk data lets owners reduce loss frequency and severity, lets brokers package more credible submissions, and lets insurers price with confidence and improve loss ratios. The same dataset has a different value to each stakeholder, which is the foundation of a data sharing model.

It supports new and emerging value streams. Verifiable operational data can substantiate sustainability and efficiency improvements, and structured, defensible data is increasingly recognized as an intangible asset, which connects directly to balance sheet value.

Data is among the most valuable assets an organization owns, yet in most portfolios it sits as a stranded asset: generated continuously, stored at cost, and used for nothing.

The mechanism that makes this safe is governance. Permissioned data sharing, controlled definitions, and end-to-end traceability from source data to reported KPI let an owner share value without surrendering control or compromising security. Data is understood in terms of both its value and its risk, and it is governed accordingly.

The sequence matters for a CFO. A portfolio does not buy a platform to monetize data in the abstract. It adopts TCRO to manage a cost it can finally see, and in doing so it builds the structured, governed data foundation that makes monetization possible. Lower TCRO and monetizable data are not two initiatives. They are two returns on the same investment.

Proof

The case for TCRO does not rest on a model. It rests on outcomes in real portfolios, measured with audit-ready data.

A major events and entertainment campus in British Columbia

A 184-acre campus of seven buildings, the newest built in 1970, ran on reactive maintenance with no way to see inside aging infrastructure before it failed. Novem deployed predictive sensors across the highest-risk assets, layered on top of existing systems without replacement. Vibration monitoring on an aging ice-making plant motor caught a developing failure and prevented a maximum probable $5M insurance claim, and a seismic valve installation surfaced an undetected natural gas leak costing more than $400,000 per year. A lighting modernization cut electrical operating costs by 30% with a 4.5-year payback. Across the deployment, annual insurance premium growth held at 0%, and funds once spent on crisis response were redirected into planned capital. Aging infrastructure did not have to be a liability once its risk became visible.

A boutique independent seniors living developer in British Columbia

Insurance costs across construction and operations were escalating and treated as uncontrollable — a fixed cost of building in a hardening market. Rather than carry construction and operational risk as separate problems, the developer managed them as one integrated, data-driven system across the full insurance lifecycle, from Course of Construction through occupancy. The result was a 10% reduction in insurance costs across all three policy types, a 30% reduction in digital infrastructure capital spend versus the original budget, and a combined 1% reduction in total construction costs. For a developer working compressed margins, those are not incremental improvements. They are the difference between a project that works financially and one that does not, and the data foundation that delivered them is now in place for every project that follows.

A regional seniors living operator in Western Canada

A single flu season had produced 19 consecutive weeks of outbreak across roughly 120 residents, driving extended isolation, heavy wage premiums, and rising PPE cost that was treated as unavoidable. Continuous monitoring of CO2, humidity, temperature, particulate matter, and volatile organic compounds, paired with predictive analytics, identified elevated-risk conditions before outbreaks occurred. Over three years the operator cut outbreak weeks by 65%, reduced outbreak wage premiums by 65%, and saved $18,771 in PPE spend — and went 12 consecutive months with zero respiratory outbreaks. Approximately 200 residents and 110 employees benefited directly. Behind every avoided outbreak week is a resident who kept their family visits, a care team that did not work a crisis shift, and a board that had evidence instead of anecdotes.

The framework is validated by two of the organizations whose data makes it defensible at scale: a global digital energy and building services company, one of the world's largest sources of building infrastructure data, and a global commercial insurance company contributing 20 years of claims experience. Risk reduction is grounded in real loss data, not assumptions — which is what allows a TCRO number to stand up to a board, a lender, and an underwriter.

Behind every avoided outbreak week is a resident who kept their family visits, a care team that did not work a crisis shift, and a board that had evidence instead of anecdotes.

What Adoption Looks Like

TCRO is a standard a portfolio adopts in stages, not a switch it flips. The barrier is rarely technology access. It is readiness: whether the portfolio has the data foundation, the workflows, and the reporting infrastructure to act on what measurement surfaces. Leading owners move through four stages.

1. See everything you own. Build a complete inventory of critical systems and equipment across every building, including age, condition, replacement cost, and business importance. A portfolio cannot measure the cost of risk it has not inventoried.
2. Establish continuous measurement. Connect real-time monitoring and normalized claims data into a common data environment so the TCRO number becomes a live measurement rather than a one-time estimate. This is the step that turns a framework into a management system.
3. Predict and prevent. Act on early failure signals to schedule interventions at standard rates during planned downtime, reducing emergency premiums and extending equipment life. This is where TCRO begins to fall.
4. Prove and improve. Track risk reduction and financial outcomes with audit-ready reporting for executives, boards, lenders, brokers, and insurers, and feed those results back into capital and insurance decisions. This is where the data foundation also becomes a monetizable asset.

The discipline that separates leaders is not more data. It is signal discipline, so teams act on what matters most; audit-ready reporting, so evidence assembles itself rather than being reconstructed under deadline; and portfolio-level visibility, so leadership allocates resources by actual exposure rather than by the loudest alarm.

Conclusion

The institutional real estate market is moving toward a new definition of financial discipline — one measured not by how well a portfolio recovers from failures but by how precisely it prices and prevents them. Total Cost of Risk Ownership is the standard that makes that discipline possible. It replaces a number built for insurers with a number built for owners, and in doing so it turns risk from a hazard endured into a cost managed.

The same move unlocks a second return. The structured, governed data required to measure TCRO is the data that can be monetized — through lower costs, stronger insurance economics, and recognition of data as an asset. Owners who adopt TCRO are not choosing between reducing risk and creating value. They are doing both with one investment.

The data already exists in every instrumented portfolio. The advantage goes to the owners organized to measure it, act on it, and prove it. The organizations that predict failure first will lead. Behind every number in this paper is a building that kept its trust, a resident who kept their heat, and a balance sheet that kept its strength.

Failures are Predictable.

You have seen the framework. Total Cost of Risk Ownership is the single number that ties together what your portfolio carries.

• T — Total every cost, insured and hidden
• C — Cost measured in real dollars
• R — Risk: failures, downtime, exposure
• O — Ownership: what your portfolio carries

The next step is to see what TCRO looks like for your buildings.