Five risk scenarios to test operational response and insurance policy questions, from cyber to injury

A scenario turns broad concern into an operational test. It does not prove that a policy will respond. Use the exact issued wording, schedule and endorsements, then involve the insurer, intermediary or qualified adviser where interpretation is uncertain. If you cannot find the issued wording and schedule, ask the broker or insurer for a copy.

What to take away

1. Cyber incident disables customer service

Assume an account is compromised overnight, the main platform is unavailable and customer information may have left the business. Test detection, authority to isolate systems, alternative contact routes, evidence preservation, regulatory assessment, policy notification and customer communication.

The cover that answers this scenario is cyber insurance, which commonly funds incident response, system restoration and claims arising from a data or network event. Ask what limit applies, what excess the business carries, which exclusions could bite and how quickly the insurer must be told. A reportable personal data breach must be notified to the Information Commissioner's Office within 72 hours of the business becoming aware of it, so the same test should show who makes that call and who can reach the insurer's incident line out of hours.

The government's Cyber Security Breaches Survey 2025/2026 reports UK survey findings and detection limitations by business size. Use it for background, not to estimate the organisation's chance of a claim.

2. Premises damage interrupts trading

Assume escape of water makes the main premises unusable. Identify the property section, any business-interruption trigger, indemnity period, evidence for turnover and additional costs, supplier dependencies and alternative location.

Test whether remote access still reaches policy and financial records. Record landlord, utility, emergency contractor, insurer and broker contacts outside the affected system. Compare the recovery assumption with realistic replacement and approval times.

Property damage insurance responds to the building and contents, and business interruption cover responds to the resulting loss of turnover and the additional costs of trading elsewhere. Ask how the sum insured was calculated, whether the indemnity period reflects a realistic rebuild or relocation time, what excess applies and which exclusions and notification conditions sit in each section. The test should also show what evidence of turnover and additional cost can be produced if the insurer asks for it.

3. An AI-assisted output causes loss

Assume a staff member relies on an AI-generated summary that omits a material customer instruction. Test the approval control, source documents and notification terms, and preserve prompts, model version and human edits where lawful.

The ICO's artificial intelligence guidance supports assessment of personal-information risk and explanation, but it does not decide contractual liability or coverage.

Liability for faulty professional advice or a technology failure is usually addressed through professional indemnity insurance, often written as technology errors and omissions cover for firms that supply software or digital services. Ask whether AI-assisted work is expressly excluded, whether the limit is per claim or in aggregate, what excess applies and what must be notified and when. A cyber policy may also respond if the same event affects personal information or systems.

4. A critical supplier fails

Assume a cloud, payment, logistics or specialist service stops with no reliable restoration time. Test an alternative process, decision authority and how long the business can operate safely.

For regulated firms, the FCA's operational incident and third-party reporting policy creates requirements from 18 March 2027 within its stated scopes. Other businesses can still use the dependency prompts without claiming the rules apply to them.

Supply-chain exposure normally sits in the business interruption section, sometimes with extensions for denial of access or the failure of a named supplier. Ask whether unnamed suppliers are included, how long the indemnity period runs, what excess applies and what evidence of the dependency the insurer will expect. Where cover depends on damage at the supplier's premises, the wording usually says so, and any change to the suppliers named in the policy should be checked with the broker.

5. An employee and a visitor are injured

Assume one event affects a worker and a customer at a trading site. Test emergency response, factual recording, witness and image handling, preservation of equipment, internal escalation and separate notification paths. Do not admit or deny liability without authority.

The Health and Safety Executive provides a risk assessment approach and template for Great Britain. Insurance cannot replace hazard control, and the exercise should identify practical prevention as well as possible transfer.

Two policies answer this scenario. Injury to the worker falls under employers' liability insurance, which the Employers' Liability (Compulsory Insurance) Act 1969 requires almost every employer to hold, with a certificate the business should be able to produce. The visitor is normally dealt with under public liability cover, often written as occupiers' liability for a customer injured on the premises. Ask whether each limit is enough for a serious injury, what excess applies, which exclusions attach to each section and how quickly a claim or circumstance must be notified.

Run and record the exercise

Give participants incomplete facts and a realistic clock. A typical session lasts about two hours and involves six to ten people. Observe who notices the event, who may spend money, who contacts customers and who makes policy or regulatory notifications. Introduce one failure, such as an inaccessible password vault or absent decision-maker.

Record decisions, delays, missing evidence and policy questions. Assign each improvement an owner and deadline, then repeat the failed section. Review scenarios after a new activity, supplier, location, policy edition or serious near miss. The aim is not a flawless tabletop conversation; it is a recoverable operation with a defensible record.

For example, in a cyber test the team decided to isolate the platform at 09:20. The insurer was called 40 minutes late. Chat logs were overwritten, so the evidence was missing. The operations manager owns a new call tree, due 30 June.

Keep exercise material separate from live incident records and label it clearly. Invite suppliers only where their role is defined, protect personal information used in the test and agree how observations will be shared. The final report should distinguish a control failure from an unanswered coverage question so the right person resolves each one.

Before you act

Common questions

What should a business do when policy interpretation is uncertain?

The article says to use the exact issued wording, schedule and endorsements, then involve the insurer, intermediary or qualified adviser where interpretation is uncertain. A scenario does not prove a policy will respond, so the exercise should separate a control failure from an unanswered coverage question.

How should a business run the exercise itself?

Give participants incomplete facts and a realistic clock. Observe who notices the event, who may spend money, who contacts customers and who makes policy or regulatory notifications. Introduce one failure, such as an inaccessible password vault or absent decision-maker, then record decisions, delays, missing evidence and policy questions.

When should scenarios be reviewed again?

Review scenarios after a new activity, supplier, location, policy edition or serious near miss. The aim is not a flawless tabletop conversation but a recoverable operation with a defensible record.