Underinsured and You Do Not Know It: 6 Risk Transfer Rules for Private Companies

A friend who runs a mid-sized food business in Spain lost a warehouse roof in a storm. He was insured. He had been insured for nineteen years without a single claim. The building was rebuilt and the check arrived, and it covered almost exactly half of what the incident actually cost him, because the roof was the cheap part. The expensive part was the four months he could not ship, the two accounts that found another supplier in week six, and the fact that his business interruption limit had been set against a revenue figure from a year when the company was 40% smaller.

He was not uninsured. He was underinsured, and he had no idea, which is the normal condition. A 2025 Hiscox study found that 77% of US small businesses are underinsured. A 2026 ERGO NEXT survey put the figure at 73%, and added the more useful number: 64% of small businesses that do carry insurance are not covered for all the major risks they actually face.

The dangerous gap in a private company is almost never the policy you forgot to buy. It is the policy you did buy, in an amount that made sense the year you bought it.

I run a group founded in Azagra in 1890 that operates eight active verticals in more than 75 countries with over 180 people. A vineyard fears hail and frost. A construction arm fears a subcontractor's injury. A distribution business fears a customer that stops paying. None of those are solved by the same instrument, and only some of them are solved by insurance at all.

Here are the six rules we use.

Rule 1: Stop asking "are we insured" and start asking "what does the check replace"

"Are we covered?" is a yes/no question, which is exactly why executives like it. It is also useless, because the answer is almost always yes and it tells you nothing.

The better question has a number in it: if this event happens on a Tuesday, what does the insurer actually pay, over what period, and what does that leave us to fund ourselves?

A policy is not protection. A policy is a promise to pay a specific amount under specific conditions, and your exposure is everything outside those two limits.

Run it on your three largest physical assets and your three largest revenue streams. For each, write down the loss scenario, the policy limit, the exclusions, and the honest estimate of total cost including the months of disruption. The gap between the last two columns is your real risk position, and building that page takes an afternoon.

Rule 2: Business interruption is the coverage that fails, and it fails on time, not on money

Property insurance is easy to get right, because a building has a value everyone can see. Business interruption is where private companies get hurt, for two structural reasons.

The first is the limit. Owners set business interruption cover against last year's revenue, then grow, and never revisit the number. If you have grown 40% since the policy was written, you are 40% short at the exact moment you need it most.

The second is the restoration period, and this is the one almost nobody checks. Your policy pays for the time it is contractually deemed to take to rebuild, not the time it actually takes you to get back to your old revenue. Permits, specialist equipment with a nine-month lead time, and a supply chain that has moved on do not care what the schedule says. If your policy assumes six months and reality is fourteen, you have eight uninsured months of fixed costs.

Then there is contingent business interruption, which covers you when a supplier's disruption stops you. Read the trigger carefully. Standard contingent cover typically requires physical damage to the supplier's property. A supplier who fails because of a tariff, a sanction, a cyber incident or simple insolvency generally does not trigger it at all. If your production depends on one plant in one country, that policy may not do what you assume it does.

Rule 3: Sort every risk into retain, transfer, or remove

Insurance is one of three tools, and it is the one people reach for first because it requires no operational change. That is precisely why it is overused.

• Remove. Change the business so the risk cannot occur. Dual-source the component. Stop taking payment terms from that customer. Move the server. This is the only option that costs nothing every year forever.
• Reduce. Keep the risk but shrink it. Sprinklers, backups, segregation of duties, a second warehouse. Cheaper than premium, and it lowers premium too.
• Transfer. Insurance, or a contract clause that puts the risk on the counterparty. Appropriate for losses that are severe and rare.
• Retain. Accept it and fund it yourself, deliberately, with cash or a facility.

Anything you have not consciously placed in one of those four boxes is retained by default, and default retention is how companies discover exposures at the worst possible moment.

Rule 4: Buy the tail, not the middle

Most private companies buy insurance backward. They carry low deductibles, which feels prudent, and modest limits, which feels affordable. That is exactly inverted.

A 5,000 loss is an operating expense. You should pay it out of cash and never involve an insurer, because claiming for small losses raises your premium and your loss history, and you paid for the privilege in the first place through a low deductible.

The loss that ends the company is the one at the far end of the distribution: the fire, the liability judgment, the multi-year interruption. Raise your deductibles until they hurt slightly, and spend the savings on limits high enough to survive the event you cannot survive.

One technical point worth knowing when you go up-market on liability cover. A deductible and a self-insured retention are not the same thing. With a deductible, the insurer generally handles and pays the claim and seeks reimbursement from you. With a self-insured retention, the carrier pays nothing until you have spent the retention amount yourself, including defense costs. If you take a large retention on a directors and officers policy to cut premium, make sure the cash to fund it is genuinely available, because the insurer will not move until it is spent.

Rule 5: The risks that matter most usually have no policy

Here is the uncomfortable part. Rank the things that could realistically destroy a private company, and most of the top of that list is uninsurable.

• Customer concentration. No product replaces the account that was 40% of revenue.
• Key person dependency. Key person insurance pays a lump sum if someone dies. It does nothing if they resign, burn out, or join a competitor, which are far more likely. The policy is a liquidity bridge, not a succession plan.
• Reputation. A recall, a scandal, a bad year of reviews.
• Regulation. A rule change that makes your product harder or costlier to sell.
• Succession. The generational handover that goes wrong.

Note the pattern: insurable risks are events, and the risks that actually kill companies are conditions. Events get a policy. Conditions get a decision, usually an unglamorous structural one made years before it matters. The 2026 gap lists put cyber liability, employment practices liability, equipment breakdown and thin umbrella limits at the top for good reason, but even a perfect insurance program leaves the conditions untouched.

Rule 6: Read the contracts you signed before you read the policies you bought

A large share of the risk on a private company's balance sheet was not bought from an insurer. It was signed into a commercial contract by someone who did not read the indemnity clause.

Three places to look this month:

• Indemnity and hold-harmless clauses in your customer and landlord agreements. You may have contractually accepted liabilities your policy specifically excludes, which is the worst of both worlds.
• Certificates of insurance from suppliers, subcontractors and hauliers. Ask for them, check the limits and the expiry date, and check that you are named as an additional insured where it matters. A subcontractor whose cover lapsed is your problem the day something happens.
• Limitation of liability caps in what you sell. If your contracts cap your exposure at the value of the order, you have transferred risk for free. If they do not, you have accepted unlimited exposure for free.

Contract review is the cheapest risk management available, because it costs a lawyer's afternoon rather than a premium every year for the rest of the company's life.

Key Takeaways

• Underinsurance is the norm, not the exception: 73 to 77% of small businesses are underinsured, and roughly two thirds of those that carry cover are not covered for all their major risks.
• "Are we insured?" is the wrong question. Ask what the insurer pays, over what period, and what that leaves you to fund.
• Business interruption fails on the restoration period more often than on the limit. Check whether the deemed rebuild time matches reality.
• Contingent business interruption usually requires physical damage to your supplier. Insolvency, tariffs and cyber incidents typically do not trigger it.
• Buy the tail: high deductibles, high limits. Small losses are operating expenses, not claims.
• The risks that end companies, concentration, key person dependency, reputation, regulation and succession, are conditions with no policy attached. They need structural decisions.
• Read your indemnity clauses and your suppliers' certificates of insurance. Much of your real exposure was signed, not purchased.

Frequently Asked Questions

What is business interruption insurance and what does it actually cover?

Business interruption cover replaces the income you lose and the fixed costs you keep paying while an insured event stops you trading. It is triggered by a covered physical loss, such as fire or storm damage, and it pays only for a defined restoration period. It does not cover lost income from events that caused no physical damage to your property, which is why so many claims disappoint.

Why are so many small businesses underinsured?

The most cited reasons are cost concerns, the absence of a legal requirement to carry the cover, and genuine difficulty identifying gaps in the first place. The mechanical cause is simpler: limits are set once and the business grows past them. A policy written against last year's revenue is short by exactly the amount you grew.

What is the difference between a deductible and a self-insured retention?

With a deductible, the insurer typically administers and pays the claim and then recovers your share. With a self-insured retention, the carrier pays nothing until you have spent the retention amount out of your own pocket, including legal defense costs, after which the policy responds up to its limit. The practical difference is cash: a retention requires you to have the money available before the insurer moves.

Is key man insurance tax deductible?

Premiums for key person insurance are generally not deductible as a business expense, while the death benefit is typically received tax free. Confirm the treatment in your own jurisdiction with your accountant, because the rules differ by country. The more important point is scope: it pays out on death, not on resignation.

Which insurance gaps are most common in 2026?

Advisers consistently list cyber liability, employment practices liability, business interruption limits and restoration periods, equipment breakdown, hired and non-owned auto, professional liability, flood and earthquake, and umbrella limits that were adequate five years ago. Cyber and employment practices are the fastest growing of those.

One thing to do this week

Take your single largest facility and write one page: what happens if it stops on Monday. Revenue at risk, fixed costs that continue, the policy limit, the restoration period in the wording, and your honest estimate of how long you would actually need. If the last two numbers do not match, you have found your gap, and you found it on a quiet afternoon instead of in a claims meeting.

Explore how the eight divisions of Manzanos Enterprises fit together, and for the decisions that sit next to this one, read six tests for key person risk, why no single account should be able to kill your business and how to negotiate with your bank before you need to.