Risk, Insurance & Incident Records

What this guide covers

• Common business policy types: GL, commercial auto, workers’ comp, professional liability, cyber, bonds
• Certificates of insurance, limits, deductibles, exclusions, and customer requirements
• Incident reports across a range of risks: injury, property damage, data breach, product or service failure
• Notification timelines, claim cooperation, and corrective action
• Record retention and a minimum viable risk file
• Why insurance without supporting documents still leaves you exposed

Business insurance types — what each addresses

Business insurance transfers specific financial risks to carriers in exchange for premium. No single policy covers everything. Match policies to how you actually operate — not to the cheapest bundle an agent sold without reviewing your activities.

General liability (GL)

Covers third-party bodily injury and property damage arising from your operations — a customer slipping in your retail space, a consultant’s equipment damaging a client’s office, damage caused during on-site work at a customer’s location. GL does not cover your own injured employees (workers’ comp), your own vehicle collisions (commercial auto), or professional mistakes in advice (professional liability). Client and customer contracts often specify minimum GL limits — commonly $1 million per occurrence — and may require your entity as additional insured.

Commercial auto

Covers vehicles used for business — owned, leased, or sometimes hired — whether that's a delivery van, a service vehicle, or a sales team's cars. Personal auto policies typically exclude business use and hauling for hire. Commercial policies address liability, collision, comprehensive, and uninsured motorist coverage for work vehicles. If employees drive personal vehicles for errands, hired and non-owned auto liability may be needed. Trailers towed for work are one specialized example that may require additional coverage verification.

Workers’ compensation

Covers medical costs and lost wages for work-related employee injuries, and limits certain employee lawsuits against employers. Requirements vary by state, employee count, and industry — some states mandate coverage from the first employee; others have exemptions for very small employers or certain owner-only structures. Operating without required workers’ comp exposes you to fines and personal liability for injury costs.

Errors and omissions (E&O) / professional liability

Covers financial harm from professional services — a faulty design, a missed deadline causing client loss, bad advice, a bookkeeping error, data handling mistakes in consulting or technical work. GL excludes “professional services” errors. If you sign contracts promising deliverables or outcomes, professional liability may be contractually required even when you also carry GL.

Cyber liability

Addresses data breach response, notification costs, credit monitoring, ransomware, and sometimes business interruption from an online account compromise or other IT incident. Relevant if you store customer data, process payments, or operate online systems. GL policies often exclude cyber events or cap them narrowly.

Surety bonds

Not insurance — a bond guarantees performance or payment to a third party if you fail to meet obligations. Common in construction, licensing, and government contracts. Clients may require a bond instead of or in addition to insurance.

COIs, limits, deductibles, and exclusions

A certificate of insurance (COI) is a summary — not the policy. It shows carrier, policy numbers, effective dates, and limit amounts. Always request COIs from vendors and subcontractors before they start work and verify they match your contract requirements.

Limits are maximum payouts per occurrence or aggregate period. A $1 million per occurrence / $2 million aggregate GL policy pays up to those caps — catastrophic claims can exceed them, especially with multiple claimants.

Deductibles are your out-of-pocket before the carrier pays. Business policies may have per-claim or self-insured retentions. Know amounts and keep cash reserves accordingly.

Exclusions define what is not covered: intentional acts, known pollution, certain subcontracted work, aircraft, punitive damages in some states, contractual liability beyond standard coverage, work performed without required licenses. Read endorsements — modifications that add or remove coverage — not only the COI summary.

Client or customer requirements appear in contracts: minimum limits, additional insured status, waiver of subrogation, primary/non-contributory language, specific cancellation notice periods. Failing to meet contractual insurance terms can void your right to payment or trigger default even when no claim occurred.

Incident reports — what to capture immediately

An incident is any event that could give rise to a claim — customer or employee injury, property damage, a professional error, a data breach or online account compromise, a product or service defect, a vehicle incident, theft, business interruption, a harassment complaint, or a supplier failure that disrupts your operations. The first hours determine whether you have evidence or a guessing game.

Document:

• Date, time, location — GPS or site address, weather if relevant
• People involved — names, roles, contact information, witnesses
• Description — factual sequence without admitting legal fault; stick to observable events
• Photos and video — wide context and close detail of damage, conditions, equipment, PPE in use
• Equipment and materials — serial numbers, maintenance status if known
• Injuries — visible injuries, first aid given, whether EMS or hospital transport occurred
• Property damage — what was damaged, owner, estimated scope
• Data or account exposure — what system or data was affected, when it was discovered, and what access was involved
• Near misses — events that could have caused harm but did not; critical for prevention and sometimes required by safety programs

Separate witness statements when possible — one person’s unified story written by the supervisor looks coached. Have involved parties sign factual corrections, not admissions of liability drafted by you.

Notification timelines and claim cooperation

Policies require prompt notice of incidents that may become claims — “as soon as practicable” is common language. Delayed notice gives carriers grounds to deny coverage. Know your agent’s after-hours claim number before an incident, not during one.

When in doubt, notify. A near miss that later develops into an injury report still has an earlier clock. Document when you notified, who you spoke with, and claim number assigned.

Claim cooperation means providing statements, records, and access as the carrier requests — while protecting privilege with your attorney when litigation is likely. Do not destroy or alter records after an incident. Do not admit fault to third parties on behalf of the insurer without guidance. Do not settle directly with a claimant without checking whether your policy requires carrier consent.

Workers’ comp claims have separate reporting rules to the state board and carrier — often within days of knowledge of injury. Missing statutory deadlines creates independent penalties.

Corrective action and retention

Every significant incident or near miss deserves a corrective action review: what failed — procedure, equipment, training, supervision — and what changes prevent recurrence. Link corrective actions to SOP updates and retraining records. Insurers and regulators ask what you changed, not only what happened.

Retention: Keep incident files, photos, witness statements, claim correspondence, and closed claim summaries for the period your attorney or accountant recommends — often years after resolution, varying by claim type and jurisdiction. Insurance policies, COIs, and renewal declarations should be retained for the life of the business plus a buffer. Digital backup with off-site storage protects against loss of the insured premises.

Insurance without docs is still messy. At claim time you need policy numbers, declarations pages, endorsements, COIs you issued and received, maintenance logs, training records, and the incident file — not a memory that “we were covered.”

Minimum viable risk file

Maintain one organized location — cloud folder plus local backup — containing:

• Current declarations pages for every active business policy
• Agent and carrier claim reporting contacts, 24/7 if available
• Blank incident report template accessible to supervisors or team leads
• COI folder: yours to issue, plus vendors’ and subcontractors’ COIs with expiration alerts
• Client or customer contract insurance requirements cross-referenced to your coverage
• Vehicle registration, inspection, and maintenance summary for commercial autos, where applicable
• Workers’ comp policy and state posting requirements where applicable
• Incident log index — date, location, type, status, claim number
• Corrective action tracker tied to incidents and near misses

Review quarterly: coverage still matches operations? Vendor COIs expired? Limits still meet largest active contract? New services added without telling your agent?

Common mistakes

• Assuming an LLC or personal umbrella replaces business GL and auto coverage
• Using a personal vehicle for business deliveries without commercial coverage disclosure
• Delaying insurer notice because “it might blow over”
• No photos or records at the time of an incident — disputes become word against word
• Accepting vendor COIs without verifying additional insured endorsements
• Buying lowest-premium GL without reading exclusions for your industry
• Storing policy documents only on a laptop that gets stolen or destroyed
• Treating near misses as luck instead of free warning data
• Failing to update your agent when business activities expand into new services

When professional guidance may be needed

Licensed commercial insurance brokers and agents should place and review business coverage. An attorney helps with contract insurance clauses, claim disputes, and settlement strategy. Accountants coordinate deductibility of premiums and reserves. Safety consultants support OSHA or industry-specific programs. For significant injuries or regulatory investigations, involve counsel early — statements made before representation can bind coverage.

This guide is educational literacy about systems and vocabulary, not a recommendation to buy, cancel, or change any specific policy.

Related Business & Systems resources

• Standard Operating Procedures
• Hiring, Contractors & Team Control
• Delaware LLC Literacy
• Insurance Fundamentals
• Business Emergency Fund