How companies should design a corporate insurance programme

Corporate insurance bought as a series of separate purchases produces a predictable outcome: two policies covering the same exposure, and a third exposure covered by neither. A programme is what you get when the whole set is designed together against a map of the actual business.

Begin with exposure mapping

List every location with its values at risk. List contractual obligations that create indemnity exposure. List employee groups and their working conditions. List products and the jurisdictions they reach. List the systems and vendors the business cannot operate without. List the individuals who owe fiduciary duties.

Then estimate, for each, the plausible maximum loss and the frequency. That grid - severity against frequency - is what tells you what to retain and what to transfer. High-frequency, low-severity events are usually cheaper to absorb through deductibles than to insure.

Decide what you are retaining

Deductibles are not a way to make the premium look better; they are a deliberate financing decision. Set them at a level the balance sheet can genuinely absorb without disruption, and take the premium saving into higher limits where the tail risk actually lives.

The common error runs the other way: low deductibles that generate frequent small claims, damage the loss ratio, and drive renewal pricing upward, combined with limits too low for the one event that would matter.

Insurance works best when the policy language mirrors the business model.

The layers of a typical programme

Property and business interruption across all locations, ideally on one policy with one renewal date and one set of definitions. Liability: public, product, and where relevant professional. Marine cargo for goods in transit, on an open cover or sales turnover basis rather than shipment by shipment.

People: group health, group personal accident, group term life, employee compensation. Management liability: directors and officers, employment practices, crime and fidelity. Technology: cyber, covering both first-party costs and third-party liability.

Then the specific ones that only some businesses need - credit insurance for receivables, contractors all risks for construction, machinery breakdown, product recall, trade credit, political risk.

Align the contract stack with the insurance stack

Commercial contracts create insurance obligations and, frequently, insurance problems. Indemnity clauses may assume liabilities broader than the policy responds to. Waivers of subrogation may prejudice the insurer. Certificate requirements may specify limits you do not carry. Additional-insured requests may need an endorsement.

The practical fix is a standing review: significant contracts go past whoever manages insurance before signature. This is unglamorous and prevents most of the disputes that otherwise surface at claim stage.

Prepare for claims before you have one

Write down who intimates a claim, within what timeframe, and to whom. Keep the schedules and wordings somewhere accessible to more than one person. Know which policies require immediate notification and which have condition-precedent notice provisions - cyber and liability policies commonly do, and a late notice on those is a real problem.

Run the notification process once as a drill. The first time a company works out how to notify a cyber policy should not be during an actual incident.

Review annually and after every material change

Acquisitions, new geographies, new product lines, significant new customers and changes in the board all alter the exposure map. A programme that is only revisited at renewal will lag the business by up to a year, which is exactly long enough for a gap to matter.