A six-step insurance strategy framework, from exposure register to approved review

A business insurance strategy decides which losses an organisation will prevent, reduce, transfer or retain. It starts with activities and consequences, not a product list: assign owners, then test whether policy wording and quotations really transfer the intended loss. The useful outcome is a visible record of what remains uninsured and why.

What needs to be inside the plan's boundary?

Name the legal entity, trading activities, people, locations, assets, contracts and period covered. Include home-based work, customer sites and overseas activity where relevant. State a practical goal, such as protecting twelve months of recovery funding after insured property damage while meeting contractual and legal requirements.

Do not define success as fully insured. Every policy has limits, exclusions, conditions and a defined insured. The strategy should expose gaps and accepted retention rather than suggest that uncertainty can be removed. Make these boundaries visible before decisions are approved, so the organisation can judge what it is willing to retain.

How do I connect cover with recovery?

Use continuity planning to identify critical activities, dependencies, recovery arrangements and exercises, then estimate how quickly revenue stops, which supplier or system is essential and how long restoration may take. The Cabinet Office business continuity toolkit prompts organisations to make those checks, giving cover decisions a recovery context.

Test a specific incident: if the main site is inaccessible for six weeks, identify the alternative workplace, its cost, the relevant policy section, notification route and cash available before settlement. Record any assumption that the insurer or broker must confirm. This turns the recovery question into a checkable insurance scenario.

What belongs in an exposure record?

An exposure register should describe credible events and their consequences, with controls and evidence attached. Interview people who run operations, hold contracts, manage staff, control systems and understand cash flow. For each event, record its cause, affected people or property, financial consequence, current control, recovery dependency and evidence owner.

The Health and Safety Executive's business basics explain the workplace risk-assessment process and the need to identify sensible controls. That assessment has a distinct legal and safety purpose. It can inform an insurance exposure record, but a policy must not replace measures needed to control harm.

How should I treat each exposure?

Use four decisions consistently for each exposure: avoid an activity or contract, reduce likelihood or consequence through controls, transfer an intended financial loss, or retain what the business can fund. Insurance belongs only in the transfer decision. These labels keep decisions consistent across scenarios.

Compare the exact wording against the scenario, including trigger, insured party, limit, excess, period, territorial scope and conditions. Check whether the terms match the loss the business intends to transfer; quotation figures alone do not replace that wording review before selection.

For public liability cover, test the trigger: injury or property damage occurring during the insurance period. The schedule's sum insured sets the limit, often £1m to £5m for a small firm. For property damage, excess is often £250 to £1,000, but the insurer sets it. Territorial scope is often Great Britain, Northern Ireland and temporary EU visits.

To size retention, compare cash available after a loss with free cash, undrawn facilities, expected claim payment time and the largest credible loss. Choose an excess the business can pay without disrupting wages or supplier payments. For example, if free cash is £20,000 and monthly payroll is £15,000, a £10,000 excess may be too high for a small firm. These figures are illustrative.

What must be checked before cover is placed?

For non-consumer insurance, the Insurance Act 2015 contains the duty of fair presentation and related knowledge and remedy provisions. Qualified advice may be needed to apply it. Assign senior management and insurance owners to gather material circumstances, present information clearly and preserve insurer questions and answers.

FCA Handbook ICOBS 5 sets demands-and-needs provisions for insurance distributors, including information obtained from the customer and consistency of a proposed contract. That regulatory process does not remove the customer's need to check the record supplied for completeness and accuracy.

Who signs off the risk left uninsured?

The owner or board should approve the risk that remains uninsured, not just the premium. In a small company, the owner signs off unless the articles or a shareholder agreement give that power to the board. Where a board exists, it approves.

Create a one-page decision register for each exposure, listing treatment, policy, retained amount, control owner, evidence, budget, unresolved point and approval. Review it before renewal, then revisit after a hire, new service, premises move, large contract, acquisition, incident or material system change.

Keep superseded decisions alongside the current register. They show why a limit, route or control changed, and prevent a later review from repeating an abandoned assumption without its original context. A sound framework makes retained risk visible and gives every live assumption a named person and review date.

What should I do first?

Start by setting the boundary, then connect credible events to their consequences, controls, recovery needs and exact policy wording. Before approval, make retained amounts and unresolved points explicit, assign evidence and disclosure owners, and set a review before renewal and after material business changes.