Insurance is one part of managing risk
Insurance can finance certain losses described by a policy. It cannot prevent an injury, restore an irreplaceable record or keep every customer after a prolonged shutdown. A resilient business combines appropriate coverage with practical controls, documented decisions and a plan for recovery.
Westoak’s insurance review can help identify questions to investigate. Legal, accounting, cybersecurity, engineering and regulatory advice should come from qualified specialists where the risk requires it.
Use a repeatable five-part process
1. Identify
List the assets, people, activities, contracts, systems and dependencies that keep the organization operating. Include third parties, seasonal peaks, key customers and single points of failure—not only property the business owns.
2. Prevent and reduce
Choose controls proportionate to the risk: maintenance, housekeeping, driver screening, equipment guards, training, access controls, payment verification, backups and incident procedures. Assign an owner and due date to each action.
3. Transfer
Use carefully drafted contracts and insurance to allocate or finance appropriate risk. An indemnity clause and an insurance policy are not the same thing. Have counsel review significant agreements, and confirm insurance requirements with your broker before signing.
4. Prepare to continue
Document critical functions, recovery priorities, alternate suppliers, emergency contacts and communication responsibilities. Test backups and tabletop plans. Review business interruption insurance against realistic recovery periods and dependencies.
5. Review
Revisit the risk register after a loss, near miss, acquisition, renovation, new contract, technology change or entry into a new market. An annual insurance renewal is useful, but material changes should not wait for it.
Strengthen cyber basics
The Canadian Centre for Cyber Security’s baseline controls for smaller organizations include incident-response planning, patching, strong authentication, backups and employee awareness. Cyber resilience requires both technology and people. Review how vendors access data, how payment changes are verified and who has authority during an incident.
Keep evidence that controls operate
Policies on a shelf are not enough. Retain inspection logs, maintenance records, training acknowledgements, backup tests, contracts, asset inventories and incident reports. These records can support better decisions and a clearer insurance submission; they do not guarantee that a claim is covered.
Connect controls to coverage
Bring your risk register, continuity plan, contracts and recent changes to the insurance review. Contact Westoak to discuss where available insurance may fit and which unresolved issues need a specialist beyond the brokerage.