The biggest risk Canadian businesses overlook isn’t the fire, flood or cyberattack itself, but how long the disruption that follows can last, according to Everett McCallum, director, technical risk services at Echelon Insurance.
“The biggest risk businesses consistently underestimate is prolonged operational disruption,” McCallum told Insurance Business.
Attention tends to go to the immediate event, he said, whether that is a fire, flood, cyberattack, equipment breakdown or supply chain interruption.
“But the physical damage is just really the beginning. The real challenge is what follows,” McCallum said.
Read more: The ‘hard-to-place’ risk enigma
Unavailable equipment, interrupted utilities, loss of access to a site, supplier problems and staff unable to do their jobs can all hit a business’s ability to serve customers, generate revenue and keep critical operations running, sometimes long after the incident, he said. Businesses need to consider how long they could operate without a critical function, what needs to be restored first and what recovery depends on.
“Ultimately the exposure is not just the event itself; it is whether the businesses can continue operating and recover before the interruption becomes significantly more damaging,” McCallum said.
The risk landscape has widened over the past few years, McCallum said.
“Canadian businesses are now managing a wider range of significant risks at the same time, and many are becoming more frequent, more severe, and more disruptive,” he said.
Extreme weather can affect site access, utilities, transportation and employees as well as property, he said. Cyberattacks can interrupt communications, transactions, production and customer service on top of compromising data. Trade tensions, tariffs and geopolitical uncertainty have made it more important to understand critical suppliers and have viable alternatives. Automation and AI are creating efficiencies, McCallum said, but they also require stronger controls, verification and human oversight.
“The common thread here is that risk profiles are constantly evolving, so the risk management practices and controls have to evolve as well,” he said.
McCallum said businesses often confuse having insurance with being ready for a loss.
“One of the most common gaps I see is assuming that having insurance means businesses are fully prepared for a loss,” he said.
Insurance provides the financial resources to support recovery, but it cannot make the operational decisions that follow an incident, McCallum said. Businesses still need to know who will lead the response, which functions must be restored first, how employees, customers and suppliers will be kept informed, and what alternatives exist if a critical facility, piece of equipment or supplier becomes unavailable.
“Those decisions are much easier to make in advance than under pressure with incomplete information,” he said.
Coverage and preparedness work together, McCallum said.
“The policy can help fund the recovery, but the business still needs a practical plan for how that recovery will happen,” he said.
The mistake McCallum sees most often is relying on what individual employees know.
“The one thing we see quite often is businesses relying too heavily on person-dependent knowledge,” he said.
Experienced staff know what needs to be done, but that knowledge is often never documented or formally assigned, McCallum said. That works until a key employee leaves, is absent or changes roles, and it can affect maintenance, inspections, emergency procedures, supplier contacts, training and corrective actions. Documentation, assigned responsibility and management oversight are not about creating paperwork, he said, but about making sure important controls don’t depend on one individual.
“If a critical process only works because one person knows how to make it work, that is a vulnerability the business may not recognize until that person becomes unavailable,” McCallum said.
Brokers should be more than a single touch point at placement, McCallum said. Instead, he said, “our brokers act as ongoing strategic advisors.”
Their relationship with clients gives them insight into how a business is changing and where new exposures are emerging, he said. Brokers can help clients understand what information insurers need, identify practical risk improvements, and bring the insurer, particularly its risk engineering team, into the conversation early and often. After a loss, the broker can also help the insurer understand the broader context, including what happened, what the business learned and what corrective action was taken to prevent a similar loss recurrence.
Read more: Canadian insurance market faces another soft year, but warning signs are emerging
“Ultimately, the broker is the critical link between the customer and the insurer, helping maintain consistent communication and bringing in the right expertise at the right time,” McCallum said.
If every business owner could fix one thing before it becomes a claim, McCallum said, it would be to have “a practical business continuity plan that people can understand and actually use, rather than just a document sitting on a shelf.”
A good plan starts with knowing the risk, he said: what could interrupt operations, which functions are most critical, how long they can be unavailable and what they depend on. It then sets out the response and recovery, including who takes charge, how people are protected, how critical operations will be restored and who needs to be informed. Finally, the plan has to be reviewed regularly or whenever there is a significant change to make sure it still reflects how the business operates and that the recovery arrangements remain practical.
“A good continuity plan won’t prevent every loss, but it can reduce confusion, shorten downtime, and help the business make better decisions when something does go wrong,” McCallum said.
