Insurance Risk Management Assessment

Purpose

This assessment evaluates the adequacy of an organization's insurance program across five critical coverage dimensions: D&O liability, E&O/professional liability, cyber liability, key-person insurance, and general commercial coverage. The output is a composite coverage adequacy score (1-5) with dimension-specific gap identification calibrated to company stage and revenue. Use this when evaluating whether insurance coverage matches actual risk exposure. [src1]

Constraints

• Requires current insurance policies, declarations pages, and broker correspondence for reliable scoring
• Not meaningful for pre-revenue solo founders — basic general liability is sufficient
• Should involve CFO, legal counsel, and insurance broker for cross-functional accuracy
• Diagnostic only — identifies coverage gaps but does not recommend carriers or policies
• Re-run at every annual renewal; also after fundraising, M&A, major contracts, or regulatory changes

Assessment Dimensions

Dimension 1: Directors & Officers (D&O) Liability Coverage

What this measures: Whether D&O coverage limits, structure (Side A/B/C), and retention levels are adequate for the company's stage, board composition, and risk profile.

Red flags: No D&O despite outside directors or investors; limits unchanged since seed stage; broad unreviewed exclusions; retention exceeds self-fund capacity. [src1]

Quick diagnostic question: "What are your D&O limits, when were they last reviewed, and have they been adjusted since your last fundraising round?"

Dimension 2: Errors & Omissions (E&O) / Professional Liability

What this measures: Whether professional liability coverage is adequate for the service delivery model, client contracts, and regulatory exposure.

Red flags: Client contracts require $5M but policy is $1M; tech company using generic professional liability; no understanding of claims-made trigger; E&O-cyber gap. [src4]

Quick diagnostic question: "What E&O limit do your largest clients require, and does your current policy meet it?"

Dimension 3: Cyber Liability Insurance

What this measures: Whether cyber insurance is adequate for digital risk exposure, data handling, and regulatory environment.

Red flags: No cyber policy despite processing PII/PHI/payment data; limits below $1M for $10M+ revenue; ransomware excluded; MFA not deployed; no IR plan. [src2]

Quick diagnostic question: "What is your cyber insurance limit, do you have MFA everywhere, and does your policy cover ransomware and social engineering?"

Dimension 4: Key-Person Insurance

What this measures: Whether financial protection exists against the loss of individuals whose absence would cause significant harm.

Red flags: Investors require key-person insurance but none exists; CEO is sole relationship holder; coverage amount unchanged despite 5x revenue growth; no disability component. [src6]

Quick diagnostic question: "Do you have key-person insurance, who is covered, and how was the coverage amount determined?"

Dimension 5: General Commercial Coverage Portfolio

What this measures: Whether the broader portfolio (GL, property, BI, workers' comp, umbrella) is adequate and coordinated.

Red flags: No BI despite physical operations; no umbrella for $10M+ revenue company; property at purchase vs. replacement cost; no EPLI with 50+ employees. [src5]

Quick diagnostic question: "Do you have business interruption insurance, and for how many months of revenue loss does it cover?"

Scoring & Interpretation

Overall Score Calculation

Overall Score = (D&O x 1.2 + E&O x 1.0 + Cyber x 1.2 + Key-Person x 0.8 + General Commercial x 0.8) / 5.0

Score Interpretation

Dimension-Level Action Routing

Benchmarks by Segment

Common Pitfalls in Assessment

• Policy existence vs. coverage adequacy: Having a policy does not mean coverage is adequate. Many organizations never revisit founding-stage limits, leaving gaps discovered only during claims.
• Cyber-E&O gap: Both policies may exist but coverage gaps or overlaps between them are common. A data breach during services delivery may trigger both or neither.
• Key-person valuation drift: Coverage amounts set at founding become inadequate as economic value grows. A CTO worth $200K at seed may represent $5M+ at Series C.
• Self-assessment bias on D&O exposure: Executives underestimate D&O exposure, believing lawsuits only affect large public companies. Private company claims are common and growing.

When This Matters

Fetch when a user asks to evaluate insurance coverage adequacy, prepare for annual renewal, conduct fundraising or M&A due diligence, respond to a board risk coverage review, or assess whether coverage has kept pace with business growth.