Due Diligence and Ongoing Monitoring

Hello all! We are having troubles getting Employee Crime Insurance/Fidelity Bond from one of our critical third parties that provides us with a SaaS that houses our confidential data in the Cloud. So, my questions:

• Do any of you have troubles getting crime coverage?
• If so, what alternatives, if any, do you look for?

It's crucial to understand whether the insurance provider is unable to offer the coverage or if the amount of insurance is insufficient. Remember, fidelity bonds often have lower coverage limits compared to commercial crime insurance policies. In some cases, these limits may not adequately address the significant risks your business faces. It's not uncommon for insurance amounts to be capped, even if the customer requests more, especially with large tech providers. However, if the issue is that they cannot obtain the coverage, it should raise some red flags.

There are a few reasons why they may not be able to get the insurance including:

• Risk Assessment: Insurance providers carefully evaluate the risk associated with each business. If a company is found to have a considerable risk of employee dishonesty or other criminal activities, insurers may be cautious about offering coverage. Factors such as the industry, location, and past claims history influence the perceived risk.
• Financial Stability: Insurers take into consideration a company's financial stability. If a business is experiencing financial instability or has a history of financial difficulties, it could potentially impact their ability to obtain insurance coverage.
• Specific Situations: In certain industries such as jewelry stores and financial institutions, businesses operate in high-risk environments. Insurers may approach these industries with caution due to the unique risks associated with them.
• Previous Claims: Insurance providers might exercise caution when considering coverage for companies with a track record of employee theft or fraudulent claims.

Since there really is not a comparable type of insurance, I recommend first discussing the issue openly with the vendor so that you can get a better understanding of the situation. If, for example they have high employee risks or have had too many past claims, it's a good indicator that they do not have appropriate controls in place, which could be the bigger risk to your confidential data. Likewise, if it is for financial reasons, I recommend doing an immediate review of their financial health. Due to the critical nature of the service, I would also recommend reviewing your exit strategy right away and preemptively beginning discussions around replacement; it's always better to be safe than sorry. Additionally, you can reach out to the insurance provider for your organization for additional guidance. I hope this information is useful for you, and I would love to hear what other members think.