What a New CFO or Operations Hire Usually Finds Wrong with the Existing Insurance Program

Coverage Limits That Have Not Been Revisited in Years

The most direct answer to the question “Is my business underinsured?” almost always lives in the property schedule. Values were set years ago and bumped by a small index at each renewal without anyone verifying whether those numbers still reflect what it would actually cost to rebuild. When a new executive asks how those figures were developed, the answer is almost always a blank stare. The real gap is usually significant.

This is the most common finding. Property values were established years ago and have been bumped by a small percentage annually without anyone questioning whether those numbers still make sense. Liability limits were set when the company was half its current size and never adjusted. Business income coverage was calculated based on revenue figures that are five or six years old.

A building insured for $75 per square foot when the actual replacement cost is $200 to $250 per square foot. That is not a coverage shortfall. That is an uninsured building.

A $6 million machine that was never added to the property schedule because the owner did not want to increase the premium. A total loss on that equipment comes entirely out of pocket.

Business income limits that would run out months before the company could actually recover from a major loss. These are not edge cases. They are the norm in programs that have not had a real review in three or more years.

The Insurance Information Institute recommends that business owners review coverage amounts and limits regularly to ensure they still reflect current values, noting that needs change as businesses grow and that inadequate limits are among the most consequential gaps a buyer can overlook.

Premium Costs Are Out of Line with the Market

When a new CFO starts asking whether the company’s insurance premiums are competitive, the answer often reveals a deeper problem: nobody has been shopping the account. A program that was competitively priced three years ago may not be today, and a business owner who has never pushed back on renewal figures may be overpaying for coverage that is also inadequate.

The incumbent broker told the new CFO that the account was difficult to place, that Travelers was essentially the only option, and that Chubb would not consider it. This was a $150,000 account. The broker either did not know the market or did not want to do the work.

We put the account out to five carriers. Everyone came back with a quote. The result was a 25% savings with better coverage. That is not because we are magicians. It is because we did the work that should have been done all along.

A new executive asking whether premiums are competitive is testing whether the broker has been earning their commission. If the program has not been marketed in years, the answer is probably no.

Signs your premiums may be out of line with the market:

Carrier Relationships Are Stale and Renewal Is on Autopilot

There is a difference between a renewal and a real renewal. A real renewal involves reviewing the entire program, questioning values, updating exposures, identifying gaps, and going to market when it makes sense.

What most mid-market companies get is the other kind: the broker sends the current information to the incumbent carrier, the carrier sends back a number, the broker passes it along with maybe a brief summary, and everyone signs off.

The relationship between the broker and the carrier becomes comfortable. Comfortable is the enemy of competitive.

A new CFO or operations director who has come from a larger company, or who has been through a rigorous insurance review before, will spot this immediately. They will ask when the account was last marketed. They will ask what other options were considered. And when the answer is that nothing has changed in four or five years, they will know exactly what they are dealing with.

You can read more about how often your program should be reviewed and what that process should actually include.

Risk Management Is Reactive, Not Proactive

Most mid-market companies do not have a risk management strategy. They have insurance. Those are not the same thing.

A new executive often finds that there is no loss prevention program, no regular safety audits, no protocol for when a claim occurs, and no one tracking the total cost of risk, which includes not just the insurance payout but the downtime, the wasted materials, the overtime, the retraining, the hiring, and the administrative burden that follow any significant loss.

The insurance broker should be driving this conversation. Most are not. They are transaction processors. They handle renewals and certificates, and when a claim happens, they report it and hope for the best. That is not risk management. That is administration.

Risk professionals use the term total cost of risk to describe the full financial impact of an organization’s risk exposure: not just premiums and deductibles, but retained losses, operational downtime, retraining, and administrative burden. The Risk and Insurance Management Society recognizes TCOR as the standard for measuring whether a risk program is actually working. For companies that only track premiums, the true cost is consistently underestimated.

What a proactive risk management program includes:

Documentation Is Scattered and Nobody Knows What Is Actually Covered

This one is almost universal. A new executive asks to see the company’s insurance policies. What they get is a stack of declaration pages from different years, some PDF files that may or may not be current, and a certificate of insurance that was issued for a specific contract request and does not represent the full program.

Nobody has a current schedule of insurance. Nobody has a summary of what is covered and what is not. The policies themselves are dense legal documents that nobody in the company has read, and the broker has not provided a plain-language summary of what the program actually does.

When you do not know what you have, you cannot know what you are missing. Business owners who ask “is my business underinsured?” rarely get a clear answer from scattered documentation. And when nobody in the organization can answer basic questions about coverage, it means the broker has not done their job.

Management Liability Coverage Is Weak or Missing

Business owners who have been asking whether their business is underinsured tend to think first about property. But the more dangerous exposure is almost always in management liability, specifically the coverages that are missing entirely. We regularly find mid-market companies that have some form of employment practices liability insurance but no directors and officers coverage and no fiduciary liability coverage.

On the EPLI side

A common problem we encounter involves companies that use a professional employer organization. The owner or CFO will say they do not need standalone EPLI because it is included in what they pay the PEO. When we ask to see that policy, we almost always find gaps.

PEO-provided EPLI is almost never enough on its own. The coverage typically does not include third-party liability. That means a customer or vendor who alleges discrimination by an employee is not covered. It only covers employees on the plan, not temporary hires, contract employees, or staffing agency workers.

And here is the part that usually shocks them:

there is a $50,000 or $100,000 deductible or retention that nobody told them about. They had no idea they were on the hook for $100,000 out of pocket before coverage kicks in on an employment claim. That is a significant exposure for a small to mid-size business, and the old broker just accepted the PEO coverage at face value without questioning it or challenging it.

On fiduciary liability

The pattern is even more consistent. Nobody in this market segment has ever explained what fiduciary liability insurance does.

When we bring it up, the pushback is predictable: “Our 401(k) is managed by Fidelity, so we are covered.”

But that does not insulate the business owner and the trustees from liability for benefit plan administration decisions. When we tell them the cost of fiduciary liability insurance is typically five to 10% of their total management liability spend, the response is always the same: “Why did nobody tell me about this before?”

Directors and officers coverage follows a similar pattern

Some companies have it, some do not. When we explain that D&O protects the personal assets of business owners and company leaders from lawsuits alleging mismanagement, and that without it they could be personally liable, the conversation changes quickly. Nobody wants to learn after the fact that they could have been protected for a relatively small cost.

Management liability gaps new executives find most often:

The Claims Reporting Mindset Is Backwards

Sitting on incidents to avoid a premium increase is one of the most dangerous things a business can do. For claims-made policies like EPLI, D&O, and cyber liability, late reporting can result in full coverage denial. The financial risk of not reporting almost always exceeds the cost of the premium adjustment that follows a reported claim.

This finding does not come from a document review. It comes from conversations. And it is one of the most dangerous patterns we see.

Business owners and CFOs are often reluctant to report claims because they believe doing so will automatically increase their premiums. So they sit on incidents. They wait. They hope the problem goes away. And by the time they do report, the situation has gotten significantly worse.

The risk here is real. Failure to report a claim on a timely basis can lead to a coverage denial. This is especially true with claims-made policies like EPLI, D&O, and cyber liability, where the timing of the report is a policy condition. But it happens with general liability and property claims as well. A small incident that could have been handled cleanly becomes a six-figure problem because nobody reported it when it first surfaced.

The question is not whether your rates will go up. The question is whether you want to pay a couple of dollars more at renewal because you reported a claim, or pay the entire claim out of pocket because you did not. When you frame it that way, the decision is obvious.

Somebody has to frame it that way. That is the broker’s job. A new executive may not flag this directly. But they will absolutely be the person who eventually discovers that an incident went unreported for months, and they will want to know why nobody had a process in place.

The Broker Relationship Is Transactional, Not Advisory

All of the findings above trace back to the same root cause: the broker is processing transactions, not managing risk. They are handling renewals, issuing certificates, and responding to questions when asked. They are not proactively reviewing the program, educating the client, identifying gaps, or pushing the business owner to address exposures that need attention.

In the account described earlier, the insurance program had been left to a junior account manager who did not understand their role in helping manage the risks of a company doing $70 million a year in sales. That is a structural problem. The brokerage assigned the account to someone who did not have the knowledge or the authority to do the job properly, and nobody was checking their work.

A new CFO or operations director will feel this immediately. At some point they will ask the question every business owner should be asking: “What am I actually getting for the commission I am paying?”

Frankly, you do not know if a better alternative exists until someone does the work to find out. That work is what your broker should be doing. If it is not being done, you are not getting what you are paying for. There is also the question of whether your brokerage has simply outgrown its ability to serve you. That is a structural problem, not a personal one.

We work with mid-market companies across many industries including wholesalers, distributors, importers, and manufacturers. The patterns described here appear in programs across all of them.