When a meat processing business in Northern Ireland declined a quote for a fire risk assessment, it had no way of knowing that within three months its manufacturing site would burn down, with two or three neighbouring businesses also losing their premises.
For Joe Hanna (pictured), head of risk management at Willis Insurance and Risk Management in Belfast, the case illustrates a recurring problem among small and medium-sized enterprises (SMEs). Resilience is often addressed only after something has gone wrong, creating an opportunity to intervene earlier.
Hanna, a construction, design and management (CDM) specialist by background who has expanded into health and safety, environmental and sustainability advisory work, said part of the problem is structural.
"The main part is because there's no regulatory requirement," Hanna said. "So it's normally led by insurance companies asking companies what they're doing."
That can make resilience dependent on the priorities of whichever insurer happens to be on the risk. Hanna described one company that had completed around 60% of a business continuity plan after an insurance surveyor requested it.
"You write it, you get to about 60% and they change out their insurance company and the next one comes in, no interest, doesn't ask for anything," he said.
Hanna also sees an "it'll never happen to us" mindset among SMEs, particularly in Northern Ireland, where he said claims and incident rates run higher than the rest of the UK, based on his own client experience.
After a neighbouring shop caught fire, the meat processing business approached Hanna for a fire risk assessment quote but did not proceed.
The widening gap between SME growth plans and broker-led risk advice is where Hanna believes independent brokers can differentiate. His client base is almost entirely SMEs, spanning construction, manufacturing, education, charities and residential care. Many lack the resources to employ specialist risk expertise internally while being too small to access the consultancy resources available to larger corporate clients.
Cyber provides another example of what can happen when preventative action is postponed. Hanna described a client that rejected recommendations to strengthen its resilience controls and purchase cyber insurance before suffering a ransomware attack within weeks.
Business continuity planning can suffer from a similar problem. Hanna said insurer-led advice is often concentrated on fire and flood total-loss scenarios, while disruption caused by pandemics, industrial disputes and other operational risks receives less attention.
Even fire risk assessments can leave a gap. They are generally focused on life safety rather than protecting the asset or ensuring the business can continue operating afterwards. A company may therefore have adequate procedures for getting everybody out safely without having considered how it would keep trading if the premises were lost.
That gap can reflect a business that has changed shape without anyone revisiting the risk picture, with many small firms effectively insuring a version of the business that no longer exists as they grow.
Hanna's argument is that these conversations should not depend entirely on what an insurer happens to request at renewal.
The challenge is becoming more complicated as the risks facing SMEs expand. Hanna sees sustainability as one example. A Northern Ireland client was challenged by a GB competitor over the carbon footprint of its lorry-and-ferry logistics, turning sustainability from a compliance consideration into a commercial issue.
That does not mean brokers or their in-house risk teams need expertise in every emerging exposure. Hanna himself uses pre-qualified specialists where an issue falls outside his expertise.
"You can't be an expert in everything. It's too much," he said.
The more important question is whether somebody is identifying the exposure in the first place. If resilience is only discussed when an insurer demands a control or a client has already suffered a loss, the conversation is happening too late.
Bringing those questions forward can turn the relationship with an SME into something broader than simply arranging cover.
