Insurance Program Review Checklist: A Practical Checklist

Summary. An insurance program is a portfolio of contracts that most companies renew rather than review, tracking a business that has changed and a set of contractual promises nobody has read against it. The gap between what a company promised its landlord, its customers, and its lenders and what its program actually provides is the most common uninsured exposure in commercial practice, and it is found by reading two stacks of paper against each other once a year. This checklist runs that review: inventory the exposures including the dependency map that sizes business interruption, extract every contractual insurance requirement, then work line by line through the coverages, the valuation and sublimit provisions, the claims-made mechanics, and the broker relationship and renewal calendar.

What this checklist is for. An annual review of a commercial insurance program. For the negotiation, see Negotiating a Commercial Insurance Program: A Practical Guide.

Phase 1 — Inventory the exposures

Property — every location, with current replacement values (not book values, and not last year's figures, because construction costs move), construction type, occupancy, protection, and exposure to flood, earthquake, wind, and wildfire.
Business interruption — build the dependency map: which locations, systems, suppliers, and customers would halt operations, and for how long. Model the loss rather than estimating it, and use the model to size the limit and the indemnity period.
Liability — products, premises, operations, completed operations, advertising, and contractual.
Professional services, which general liability excludes.
Employment — headcount, states of operation, turnover, and claims history.
Management liability — the board's composition, outside investors, and any fiduciary responsibility for benefit plans.
Data — what personal or sensitive information is held, where, and what a breach would cost.
Auto — owned, hired, and non-owned, including employees driving personal vehicles on company business, which many companies do not realize is an exposure.
Crime — employee dishonesty, funds transfer fraud, and social engineering, which is a separate insuring agreement.
Changes since last renewal — new locations, new states, new products or services, acquisitions, new outside directors, new data types, and new regulatory exposure.
Pull five years of loss runs from every carrier, and analyze the trend rather than the total.

Phase 2 — Extract the contractual requirements

This is the phase that finds the uninsured exposure, and most companies have never done it.

Pull every lease, customer agreement, vendor and supplier agreement, construction contract, loan agreement, and franchise agreement.
Build a matrix of, for each: required coverages, required limits, required additional insured status (ongoing operations, completed operations, or both), required waiver of subrogation, required primary and non-contributory wording, required notice of cancellation, and any required rating of the carrier.
Compare the matrix to the program actually in force. A company that promised $5 million of general liability and carries $2 million has a breach of contract exposure that no insurance covers.
Confirm the endorsements exist — a certificate of insurance is an informational document that expressly disclaims any amendment of the policy, and being listed as a certificate holder confers nothing.
Confirm blanket additional insured and waiver of subrogation endorsements are in place where contracts are numerous.
Confirm completed operations additional insured status where required, which is the one most often omitted and the one that matters for latent defects.
Flag any requirement the program cannot meet, and either amend the contract at renewal or add the coverage.

Phase 3 — Review the coverages line by line

General liability

Limits, aggregates, and whether a per-location or per-project aggregate is needed.
The professional services exclusion, which can remove the very risk a services company faces.
The contractual liability exclusion and its insured contract exception, which is what makes indemnity obligations insurable.
The cyber and data exclusions now standard on most forms, and whether the excluded exposure is placed elsewhere.
Products-completed operations coverage and its aggregate.
Any industry-specific exclusion applied by class rather than by underwriting.

Property and business interruption

Replacement cost rather than actual cash value, and agreed value to eliminate the coinsurance penalty on partial losses.
Ordinance or law coverage in all three parts — undamaged portion, demolition, and increased cost of construction — with a sublimit adequate for the building's age.
Sublimits reviewed against actual exposure: flood, earthquake, wind, debris removal, pollutant cleanup, property in transit, valuable papers, accounts receivable, and computer equipment. Sublimits are where large losses become underinsured.
Deductibles, including percentage deductibles for wind, hail, and earthquake.
Business interruption: the period of restoration, the extended period of indemnity, the waiting period, contingent business interruption (and whether unnamed suppliers are covered), civil authority, ingress/egress, and service interruption.
Confirm the business interruption limit was derived from a worksheet, not from a percentage of revenue.

Cyber

First-party: forensics, notification, credit monitoring, public relations, network interruption, dependent network interruption, data restoration, and extortion — with the waiting period and indemnity period checked.
Third-party: privacy liability, regulatory defense and fines where insurable, media liability, and PCI assessments.
Sublimits, particularly for social engineering and funds transfer.
Whether the insurer's panel of counsel and forensic vendors is mandatory.
Confirm the application answers about security controls are accurate as implemented, because a misrepresentation permits rescission after the loss.

Management and professional lines

D&O: Sides A, B, and C; the insured versus insured exclusion and its carve-backs; conduct exclusions requiring a final adjudication and non-imputable between insureds; severability of the application; Side A difference-in-conditions excess for outside directors; and coverage for regulatory investigations and pre-claim inquiry costs.
Employment practices: the wage and hour defense sublimit, third-party coverage, duty to defend and choice of counsel, and the prior acts date.
Professional liability: the definition of professional services matched to what the company actually does, and the retroactive date.
Fiduciary liability for benefit plans.

Other

Umbrella and excess — confirm it follows form, identify anything narrower than the primary, and confirm the maintenance of underlying insurance condition.
Workers' compensation — audit the classification codes and the experience modification factor, both of which are frequently wrong and both of which are correctable.
Auto, including hired and non-owned.
Crime, with social engineering specifically requested.
Coverage in every state of operation, including monopolistic states where workers' compensation must come from the state fund.

Phase 4 — Mechanics that decide what a claim pays

Claims-made versus occurrence for each line, and for every claims-made policy confirm the retroactive date and that it has been maintained through every renewal and every change of carrier. Losing the retroactive date on a switch is one of the most damaging and most common errors in commercial insurance.
Confirm the extended reporting period (tail) terms and price are negotiated at inception, when they are cheap, not at cancellation.
Confirm whether defense costs are within or outside the limits. Defense within limits erodes the money available to pay a judgment, and it should either be changed or reflected in the limit.
Confirm duty to defend versus indemnity-only, which is a materially different obligation.
Confirm consent to settle and any hammer clause, and negotiate a soft hammer where possible.
Confirm notice provisions — what triggers notice, to whom, in what form, and by when — and confirm the internal process routes a demand letter, charge, subpoena, or incident report to the right place within hours.
Confirm the availability of notice of circumstances on claims-made policies, which locks in the current policy year and is the most valuable and least used feature of those policies.
Confirm choice of counsel arrangements and any panel requirements.
Confirm the named insured schedule includes every entity — subsidiaries, newly acquired entities, and any special purpose entity holding real property.

Phase 5 — Broker, documentation, and calendar

Request full written disclosure of all broker compensation — commission, contingent commission, fees, and any other consideration from any source. A broker unwilling to provide it is telling you something.
Confirm the broker's team and expertise match the industry, and that the people who service the account are the ones who pitched it.
Request a written stewardship report: claims trends, market conditions, program gaps, and what changed.
Obtain complete policies with all endorsements, and review them against the binders and the proposal within 30 days of renewal. Discrepancies are common and are correctable only if found.
Maintain a coverage summary a manager can read, distributed to everyone who could receive a claim, stating what triggers a notice obligation.
Maintain a single claim intake path with a 24-hour routing rule.
Archive complete historical policies permanently, because occurrence-based liability policies respond to injury during their period regardless of when the claim arrives — a policy from fifteen years ago may answer a latent claim today.
Run the renewal calendar: begin 120 days out, submission at 90, market at 60, quotes compared on terms at 45, negotiate at 30, bind before expiration, and review the issued policies within 30 days after.
Trigger an off-cycle review on any of four events: a new state, an acquisition, a new product or service line, or taking outside investment or adding independent directors.

Common mistakes

Renewing without reviewing, so the program tracks a business that no longer exists.
Never reconciling contractual insurance requirements to the program in force.
Accepting a certificate of insurance as evidence of additional insured status.
Insured values that have not been updated for construction cost inflation, triggering coinsurance penalties.
An ordinance or law sublimit left at the default on an older building.
A business interruption limit set as a percentage of revenue rather than from a worksheet.
Losing the retroactive date when switching claims-made carriers.
Defense within limits on a policy whose limit was sized as if it were not.
Comparing renewal options on premium rather than on terms.
No tail coverage purchased when a policy is cancelled or the business winds down.

Primary authority

Coverage is contractual, so the operative authority is the policy language, the endorsements, and the state law construing them. The recurring interpretive doctrines: the insurer's burden to prove an exclusion under an all-risk form; contra proferentem construction of ambiguity against the drafter; the reasonable expectations doctrine as adopted in some states; the "eight corners" comparison of the complaint to the policy in determining the duty to defend; and the duty of good faith and fair dealing in first-party claims, with remedies that vary substantially by state.
Regulatory: state insurance codes and unfair claims settlement practices statutes; the McCarran-Ferguson Act, 15 U.S.C. §§ 1011–1015, which leaves insurance regulation to the states.

This checklist is educational and not legal advice. Coverage depends on the specific policy language issued, and state insurance law varies substantially. Consult qualified coverage counsel and a licensed broker.