Claims, Incidents & Renewals Without Drama

A). Rule Zero: Slow is smooth, smooth is fast

1. Breathe. Don’t email apologies or speculate on fault.
2. Call your broker (or carrier hotline) and say, “We need to discuss a potential claim.”
3. Preserve evidence (see Section C).
4. Open an incident log with times, actions, and names.

B). Notice & coverage preservation (what carriers expect)

• Report early. For claims-made lines (E&O, Cyber, EPLI), report claims and also circumstances you reasonably expect might lead to claims. Early notice anchors coverage to the current policy year and retro date.
• Notify via the contract path. Use the email/portal in your policy. Copy your broker. Keep the auto-acknowledgement.
• Include the basics: policy number, named insured, date/time, parties, a short factual summary, relevant contracts/COIs, and any deadlines (e.g., demand letter due date).
• Do not: admit liability, agree to settlements, or make voluntary payments (those can void coverage).
• Tender to others when appropriate: If you’re Additional Insured on a client’s GL or have an indemnity, ask your broker to tender the claim to the counterparty’s carrier, too.
• Diary all notice/time bars (e.g., “report within 60 days,” “suit within 2 years”). Missed deadlines = coverage fights.

Pro tip: Use “notice of circumstance” when a client threatens litigation or you uncover a serious error—even before a formal claim.

C). Evidence, privilege & communications hygiene

• Legal hold: Suspend deletion, preserve emails, chats, logs, backups, device images.
• Privilege: For E&O/Cyber/EPLI, let panel counsel / breach coach direct sensitive fact-finding; mark those communications “Privileged & Confidential—Attorney Work Product.”
• One voice: Assign a single spokesperson for the client and for internal comms.
• No hot takes: Avoid adjectives like “negligent,” “breach,” or “fault” in casual emails/Slack.

D). Line-by-line: How claims typically run

1) Professional Liability (E&O)

• Trigger: Demand letter, service of suit, arbitration notice, or written accusation of negligent services.
• First steps: Immediate notice; send contracts, SOWs, change orders, project emails/meeting notes, deliverables.
• Defense: Carrier appoints panel counsel; ask for your preferred firm if allowed (or a panel exception).
• Settlement: Understand the hammer clause and consent-to-settle rules before you negotiate.

2) General Liability (GL)

• Trigger: Bodily injury/property damage (e.g., attendee trips at your workshop).
• First steps: Incident report, photos, witness names, venue contract; notice to your GL and the venue/client if they’re AI.
• Defense: Usually outside limits; expect a field adjuster if injury is serious.

3) Cyber (first-party + third-party)

• Trigger: Suspected account compromise, ransomware, lost device with PII/PHI, vendor breach implicating your data.
• First steps: Use the breach hotline on your policy. The carrier will assign breach coach (legal), forensics, and PR.
• Containment: Isolate affected systems, preserve volatile data, validate backups (don’t start restores without forensics’ guidance).
• Regulatory/notification: Breach coach determines if you must notify regulators/individuals and manages timing and content.
• Funds transfer/social engineering: Immediately contact your bank’s fraud unit to attempt a recall; file FBI IC3; then notify the Crime or Cyber carrier per policy.

4) EPLI (employment practices)

• Trigger: Demand letter/EEOC charge alleging discrimination, harassment, retaliation, or wrongful termination.
• First steps: Notify carrier; forward the charge; don’t respond substantively before counsel review.
• Defense: Panel EPLI counsel; preserve HR docs, handbook, training logs, complaint intake.

5) Workers’ Compensation

• Trigger: Work-related injury or illness.
• First steps: Ensure employee gets care; file a First Report of Injury per state; notify carrier within stated time.
• Program: Use network providers when required; implement a return-to-work plan.

6) Crime / Fidelity

• Trigger: Employee theft, forged checks, ACH fraud, social engineering loss.
• First steps: Notify bank, secure records, file police report if required by the policy, then notify the carrier; follow any call-back verification requirements.

E). Cyber incident quick playbook (first 72 hours)

0–2 hours

• Isolate affected accounts/endpoints; revoke tokens; force password resets with MFA.
• Call carrier hotline; get breach coach + forensics assigned.
• Start the incident log; enact legal hold.

2–24 hours

• Forensics triage; scope systems, data touched, dwell time.
• Brief internal leaders on facts only; stop public statements.
• If funds transfer: contact bank(s) and FBI IC3, then insurer.

24–72 hours

• Confirm threat eradication & backup integrity; begin restoration with forensics’ sign-off.
• Draft stakeholder comms under counsel; PR plan ready if notifications required.
• Set cadence for updates (e.g., 2x/day until stable).

Decisions to expect: paying ransom (legal/OFAC considerations), regulator timelines, vendor notifications, and whether to rotate creds/keys enterprise-wide.

F). Managing vendors, forensics & PR (without chaos)

• Use panels where possible (pre-negotiated rates). If you must go off-panel, seek written consent.
• Define SOWs with clear deliverables (forensic images, IOCs, timeline, final report).
• Coordinate messaging: breach coach vets all external statements and client comms.
• Track hours & invoices; retainers often apply to retentions/SIRs—confirm in writing.

G). After the dust settles: learn, fix, document

• Post-incident review (30–60 minutes): what happened, root cause, what we changed (MFA, backups, training, contract clause).
• Document fixes; your broker will use them to negotiate better renewals.
• Update your playbooks and risk register.

H). Renewals without drama (a rhythm you can reuse)

Suggested timeline

• T-120 to T-90: Strategy call with broker: exposure changes, big client asks, desired limits/retentions, target markets.
• T-75: Update data pack (revenue by industry, services mix, payroll/employee states, subcontractor COIs, cyber controls). Request loss runs from carriers.
• T-60: Markets approached (admitted + programs; E&S if needed).
• T-30: Side-by-side quotes with form comparisons (see Chapter 6 grid); negotiate endorsements, retro dates, social engineering limits, hammer clause.
• T-15: Bind; clear subjectivities (signed apps, payment/finance, control evidence).
• T-10: COIs and endorsement copies ready for client portals; update the compliance pack.

Best practices

• Marketing discipline: Re-market thoughtfully—switch when you improve controls, add exposures, or the market softens; don’t churn yearly without reason.
• Leverage improvements: Convert control upgrades (MFA, encryption, training) and contract hygiene into coverage gains or credits.
• Harmonize retro dates across claims-made lines; never reset them casually.
• Right-size limits: Let client requirements and defense-inside realities guide limit choices; use excess selectively.

I). Audits & mid-term changes (no surprises)

Premium audits (GL / WC / sometimes BOP)

• What auditors want: payroll by class/state (WC), gross sales (GL), 941s/W-2s, subcontractor 1099 totals and COIs.
• Before audit: Reconcile payroll by class; gather COIs for all subs (or you’ll be charged as if payroll).
• After audit: Review classifications and auditor estimates; dispute in writing if wrong.

Mid-term endorsements to file promptly

• New states (WC 3.A / 3.C), offices, or DBAs/entities.
• New services (ensure E&O “professional services” still fits).
• New client insurance demands (AI/P&N/Waiver, dedicated limits, named project).
• Significant revenue shifts (up or down) or hiring sprees.

J). Your one-page annual insurance calendar

Monthly

• Collect subcontractor COIs; onboard/offboard access (systems & vendors).
• Check device compliance (MFA, encryption, EDR active).

Quarterly

• Contract clause review: AI/P&N/Waiver/limits in new MSAs/SOWs.
• Test backups and document restores; phishing drill results.

Semi-annual

• Exposure refresh with broker (revenue mix, client concentration, new geos).
• COI refresh for top clients and landlords.

Renewal cycle (T-120 → T-10)

• Follow the timeline in Section H.

Event-driven

• New state/entity/DBA, major client, new service line, M&A: notify broker within 10 business days.

K). Checklists (print these)

1) First Notice Kit (any line)

• Policy numbers + claim inbox/portal links
• Broker contacts (producer + service; after-hours)
• Standard notice template (facts only)
• Copy of relevant contracts/COIs
• Incident log template

2) Cyber 72-Hour Checklist

• Isolate accounts/endpoints; force resets with MFA
• Carrier hotline called; breach coach + forensics engaged
• Legal hold issued; log preservation
• Bank/FBI IC3 (if funds transfer)
• Stakeholder script reviewed by counsel
• Backup validation + forensics sign-off to restore

3) Renewal Data Pack

• Revenue by industry/service; top-client %; projections
• Employee count by state; subs %; COIs collected
• Loss runs 5 years; claim narratives + fixes
• Cyber controls evidence (MFA, EDR, encryption, backups)
• Current policies (dec pages, retro dates), required endorsements

L). Common pitfalls (fast cures)

• Late notice → Report early, even as a circumstance.
• Admitting fault / voluntary payments → Let counsel and the carrier handle communications and settlement.
• Resetting retro dates → Insist on prior acts; buy tail if you wind down.
• COIs without endorsements → Include endorsement copies or numbers with COIs.
• Missing DBAs/entities → Align all policy Named Insureds with your corporate reality.
• No HNOA while people drive → Add it now; umbrella to follow form.