Choosing a Company Insurance Program From the Policy Wording

The Problem

Every year a services company renews its insurance the same way: the broker sends a proposal, leadership compares the premiums on the summary page, and someone signs. This year, as we prepared a new placement for cyber, technology errors and omissions, management liability and a business owner’s package, I started to suspect that the summary pages didn’t tell us what we were buying.

Three things had already gone wrong before any quote arrived:

• Answers to the same question differed between application forms.
• Security-control answers had been pre-filled for us and understated what we actually do.
• Applications become part of the policy, so those errors weren’t cosmetic.

And nobody had decided how much cover the company needed. The broker recommended a limit, but no one could say why that number was the right one.

We set a rule early: no program gets selected from quote summaries. Specimen policy forms and written answers to test claims, or no signature.

Four Questions Instead of One

“How much insurance do we need?” is hard to answer as asked. I broke it into four questions, three of which turned out to be lookups:

1. Contractual floor. What do our contracts require us to carry? This one surprised us. Our own master services agreement promises separate professional and cyber minimums, but every quote offered one shared limit, so the real floor was double the headline figure.
2. Absorption ceiling. What is the largest loss the company can pay out of its own pocket? The owners set this. Above it, insurance is the only way to pay.
3. Two worst realistic events. One is a compromise of our management tooling that reaches many client environments at once. The other is a single large client suffering a destructive incident. Each was calculated as a deliberately low floor from known inputs, not as a point estimate.
4. Marginal price of limit. What does each additional million of cover cost? Once the floors exceeded every limit on offer, the answer was simple: buy toward the top of the cheap part of the curve, and stop modeling.

Every risk in the register is marked quantified (a floor with its arithmetic shown), bounded (a range) or open (the missing input named, with an owner). When an answer arrives, only the rows it affects change.

Reading What the Policies Say

The bigger task was reading the policies themselves. Every policy form and endorsement was transcribed into plain text and checked against the page images. Some PDFs had no text layer. One dropped every bold defined term during extraction, so it had to be rebuilt character by character, with OCR used for the scanned pages. Each endorsement was then read against its base form and against the others in the same set.

That reading found things no summary page showed:

• An endorsement listed only as “Amendatory” turned out to hold 22 sections of coverage changes. One of them granted bodily-injury cover that only works if a separate general liability policy is also in place.
• One carrier’s “affirmative AI” endorsement covers AI only as a way of attacking us. It excludes claims about the output of AI. None of the quoted carriers covered harm caused by AI output.
• Disputes went to mandatory arbitration with no recovery of legal fees.
• A crime sublimit stayed flat at every limit offered, and a higher limit doubled the deductible.
• The cheapest premium bought the least effective coverage once money paid outside the main limit was counted.

I also checked every figure the broker reported against the carrier’s own documents.

The Recommendation

The analysis ended in one program-selection document: a single primary policy combining cyber and technology E&O at a stated minimum and target limit, well above the original recommendation; a separate management-liability package; and the business owner’s package confirmed first and on its own.

A coverage matrix lays each risk against each policy and shows which pays first. The open questions went to the broker in writing as specific asks, and the carriers answered in writing.

How AI Fit In

I used AI developer tools in the repository to plan and run the extraction and OCR work, structure the transcriptions, and review the resulting documents, which made it practical to read about 120 endorsements instead of skimming the summary. I also wrote a standard answer bank with a form-filling procedure addressed to “whoever fills the next form, human or agent.” It produces a fill report for a person to review, so the next application tells the same story as the last one.

The judgment calls stayed with people. The owners set the absorption ceiling. An outside finance advisor supplied the decision framework. Our CEO set the rule about policy wording.

Current Status

The work is at decision. The choice has narrowed to two cyber carriers, and ten decisions are set up for leadership to make in one sitting. The method is meant to carry forward to every future renewal.