Are There Liabilities My Business May Not Know About?

Yes — and the liabilities businesses most commonly overlook are not exotic or unusual. They are routine exposures that arise from everyday business activities: signing contracts, employing people, operating vehicles, delivering professional services, handling data, and responding to government inquiries. Standard commercial insurance programs are built around the most common loss categories at scale; they are not designed to address every exposure a specific business actually carries. The gap between what a standard policy covers and what a business is actually liable for is often significant, and most business owners do not discover it until after a claim has been made.

The Most Common Business Liabilities That Go Uninsured or Underinsured

Contractual indemnification is one of the most consistently overlooked sources of liability for businesses of every size. When a business signs a contract — a vendor agreement, a commercial lease, a service agreement, a construction subcontract — it may be agreeing to indemnify and hold harmless the other party for a wide range of losses, including losses caused by the other party's own negligence. Standard general liability policies may not cover contractual liability assumed beyond what the policy specifically addresses, and the scope of what a business has agreed to defend or pay for is often far broader than the business owner realized when the contract was signed. The exposure is embedded in documents that are signed routinely and reviewed infrequently.

Employment practices liability is a significant and underinsured exposure for most small and mid-sized businesses. Claims for wrongful termination, discrimination, sexual harassment, retaliation, and wage-and-hour violations arise across every industry and at every company size. Employment practices liability insurance is a standard product in large corporate insurance programs, but many smaller businesses either do not carry it or carry limits that are inadequate for the cost of defending and resolving a serious claim. The assumption that employment disputes are unlikely or that the business would prevail on the merits does not eliminate the defense cost, which can be substantial regardless of outcome.

Cyber liability and data breach exposure is an area where the gap between perceived coverage and actual coverage is particularly wide. Standard commercial general liability policies specifically exclude or severely limit coverage for electronic data loss, data breach, network interruption, and cyber extortion. Many businesses assume that general liability or a property policy will respond to a cyber event; in most cases, it will not. A dedicated cyber liability policy addresses this gap, but not all businesses carry one, and those that do may find that the policy's scope does not align with the actual nature of a complex incident involving notification costs, regulatory response, reputational harm, and business interruption.

Professional liability — also called errors and omissions coverage — applies to any business that provides advice, designs, recommendations, analyses, or professional services to clients. General liability covers bodily injury and property damage; it does not cover financial harm caused by a professional error, an omission, or a failure to perform as expected. A consultant whose advice leads to a client's financial loss, a designer whose work contains a costly error, or a technology provider whose system fails to perform as contracted each face professional liability exposure that their general liability policy will not address. Many businesses in service industries carry no professional liability coverage at all.

Non-owned auto liability arises when employees use their personal vehicles for business purposes — making deliveries, running business errands, traveling between job sites, or visiting clients. When a personal vehicle is used for a business purpose and is involved in an accident, the business can be drawn into the resulting liability claim. The employee’s personal auto policy covers personal use; the business’s commercial auto policy covers company-owned vehicles. The gap — business use of a personal vehicle — can leave both policies arguing about who is responsible while the business faces direct exposure. Most businesses that do not own a fleet of vehicles assume they have no auto liability. They may be wrong every time an employee drives to a client meeting.

Regulatory defense costs are an exposure that most businesses carry and almost none have specifically insured. A government investigation, audit, licensing inquiry, or enforcement action does not require any finding of wrongdoing to generate significant legal and compliance costs. Responding to a subpoena, producing documents, retaining counsel for regulatory proceedings, and managing the business disruption of an extended inquiry can cost hundreds of thousands of dollars before any resolution. Standard general liability and professional liability policies are designed to respond to third-party claims — they are not designed to fund the cost of defending a regulatory proceeding, which is a different kind of exposure entirely.

Compounding all of these gaps is a structural trend in the commercial insurance industry that most policyholders — and many of their agents — are not aware of. Insurers and reinsurers have been systematically adding exceptions, exclusions, and limiting conditions to commercial policy forms over time. These additions are embedded in policy documents that commonly run over 300 pages and are almost never read in full by the insured or their agent. The review a business typically receives is a summary or a declarations page — not the underlying policy language. The exceptions being added are not disclosed in plain language at renewal; they are written into the body of a complex legal document that most businesses will never open. In practice, many policyholders are carrying less coverage than they had in prior years without knowing it. The gap between what a business believes its policy covers and what the policy actually says is growing — not because the business changed, but because the contract quietly did.

Every business is already self-insuring the gaps in its commercial program — absorbing contractual indemnification obligations, employment claims, cyber incidents, professional errors, non-owned auto liability, regulatory defense costs, and the growing list of exclusions added quietly at each renewal out of operating funds when they occur. A captive insurance company formalizes that retained risk in a legitimate, licensed structure with actuary-priced policies. It can be designed around the specific liabilities of the business rather than the standardized categories a commercial carrier will write at scale — and it builds underwriting profit, investment income, and compounding equity for the business from risk it was already carrying at no financial return. These tasks and responsibilities are typically managed by the captive manager in coordination with the business’s legal and risk advisors.

Key Points

•   Contractual indemnification is invisible until it isn’t: Businesses routinely sign agreements that shift broad liability onto them — often including the other party’s own negligence. Standard general liability policies may not cover contractual liability assumed beyond specific policy terms, leaving the business holding obligations it never intended to self-insure.

•   Employment practices claims are not limited to large employers: Wrongful termination, discrimination, harassment, and wage-and-hour claims arise at businesses of every size. Defense costs alone can be significant regardless of whether the claim has merit. Most small and mid-sized businesses carry no employment practices liability coverage.

•   General liability does not cover cyber events: Standard CGL policies exclude or significantly limit coverage for data breach, network interruption, and cyber extortion. The assumption that a general liability policy will respond to a cyber incident is one of the most common and costly misconceptions in commercial insurance.

•   Service businesses carry professional liability whether they know it or not: Any business that provides advice, designs, analyses, or professional services to clients carries errors-and-omissions exposure. General liability will not cover financial harm caused by a professional error or failure to perform. Many service businesses carry no professional liability insurance.

•   Non-owned auto liability is a gap at most businesses without a company fleet: When employees use personal vehicles for business purposes, the resulting auto liability can fall between the employee’s personal policy and the company’s commercial program. The business may face direct exposure every time an employee drives for a business purpose in their own vehicle.

•   Regulatory defense costs are almost never specifically insured: Government investigations and enforcement proceedings generate significant legal and compliance costs before any resolution. Standard liability policies are designed for third-party claims, not regulatory proceedings. Most businesses have no dedicated coverage for this exposure.

•   Commercial policies are getting narrower — quietly: Insurers and reinsurers have been adding exceptions and exclusions to commercial policy forms on a consistent basis. These changes are buried in documents that often exceed 300 pages and are almost never read by the insured or their agent. Businesses may be carrying less coverage than they had in prior years without knowing the policy changed.

What liabilities does general liability insurance not cover?

Commercial general liability (CGL) policies cover third-party bodily injury and property damage claims arising from business operations, products, and completed work. They do not cover: professional errors and omissions, employment practices claims, cyber and data breach events, contractual liability assumed beyond specific policy terms, directors and officers claims, regulatory proceedings and defense costs, or intentional acts. Each of these categories represents a distinct type of liability that requires either a separate policy or a captive structure designed to address it specifically.

How does a small business find out what liabilities it has?

A formal risk assessment that reviews actual business activities against existing policy coverage terms is the most reliable method. This means reading what the policies cover and exclude — not relying on a summary of what the policy is assumed to provide — and mapping those terms against what the business actually does: the contracts it signs, the services it delivers, the vehicles its employees use, the data it holds, and the regulatory environments it operates in. Many businesses discover significant gaps only when they go through this process for the first time. A captive feasibility study performs this analysis as a prerequisite to designing a captive program.

Can a captive cover liabilities that commercial insurance won’t?

Yes. A captive is a licensed insurance company owned by its insureds and designed to cover the specific risks of the operation — including risks the commercial market either excludes, prices prohibitively, or has not built adequate products to address. Contractual indemnification exposure, specialized professional liability, regulatory defense costs, employment practices, cyber gaps, and non-owned auto liability are all examples of exposures that a captive can be structured to cover. Because the captive is writing policies for its own owner rather than for an underwriting pool, it can be tailored to the actual risk profile of the business in ways a commercial carrier writing at scale cannot.

What is the most overlooked business liability?

Contractual indemnification is a strong candidate because it is embedded in documents that businesses sign as a routine part of operations and rarely re-examine. Employment practices liability is another, because many business owners underestimate the frequency of employment claims and the cost of defending them regardless of merit. Regulatory defense costs may be the single most universally uninsured exposure — virtually every business in a regulated industry carries it, and virtually none have dedicated coverage for it. The most overlooked liability for any specific business depends on the industry, the contracts it signs, the employees it has, and the regulatory environment it operates in.

Common Misconceptions

“If we haven’t had a claim, we don’t have a problem.”

The absence of a past claim does not reduce the exposure — it means the loss hasn’t occurred yet. Many hidden liabilities, particularly employment practices claims and contractual indemnification obligations, can accumulate for years before a triggering event. A business that has operated for a decade without an employment claim still carries the same employment practices exposure as a business that has faced one. The question is not whether the business has experienced a loss but whether the exposure exists and is adequately addressed.

“Our broker reviewed our program — we’re covered.”

A broker reviews what policies are available in the commercial market and matches them to the risks the business has identified. But brokers are not typically reading every page of a 300-page policy form at each renewal — and neither is the business. Insurers and reinsurers have been systematically adding exceptions and exclusions to commercial policy language over time, often without any plain-language disclosure to the policyholder or their agent. These changes are embedded in complex legal documents that are rarely reviewed in full. The result is that a broker can present a renewal in good faith, the business can accept it in good faith, and neither party may be aware that the coverage has narrowed in ways that will only become visible after a claim is denied. A broker cannot place coverage for a risk the commercial market has quietly excluded, and a summary review of policy terms will not surface exclusions buried deep in policy language. A captive feasibility study examines the full risk profile of the business — including what the commercial program no longer covers — and designs coverage around the actual exposure.

“We’re too small for these liabilities to apply to us.”

Business size does not scale liability exposure proportionally. A small business with ten employees can face the same employment practices claim as a company with a thousand. A small professional services firm can face the same professional liability exposure as a large one. A small business that signs a broad indemnification clause in a vendor agreement has assumed that obligation regardless of its revenue. The liabilities that businesses most commonly overlook are not limited to large or complex organizations — they arise from ordinary business activities that all businesses conduct. A well-designed captive is a legitimate insurance company with actuary-priced policies — and it can be structured for operations of appropriate scale.

Quick Summary

•   Standard commercial insurance programs are designed to cover the most common loss categories at scale — not the full range of liabilities a specific business actually carries. Contractual indemnification obligations, employment practices claims, cyber events, professional errors, non-owned auto liability, and regulatory defense costs are among the most common categories that fall outside standard policy coverage.

•   Commercial policy forms are getting narrower over time. Insurers and reinsurers routinely add exceptions and exclusions to policies that commonly run over 300 pages — documents that are almost never read by the insured or their agent. Businesses may be carrying materially less coverage than they had in prior years without knowing it, because the exceptions only surface when a claim is denied.

•   Most businesses discover coverage gaps only after a claim has been made. A review of actual business activities against the specific terms of the policy — not a summary of assumed coverage — is the only reliable way to identify where the exposure is uninsured.

•   Every business is already self-insuring the liabilities its commercial program does not cover — absorbing those losses out of operating funds when they occur. A captive formalizes that retained risk in a legitimate, actuary-priced insurance structure designed around the specific exposures of the business.

•   Underwriting profit when losses stay below premiums, investment income on reserves held in the captive, and compounding equity over time — a captive turns the self-insured liabilities a business was already carrying into a growing financial asset rather than an unpredictable cost.

3F offers appointments to explore whether there are liabilities a specific business may not know about, and whether forming a captive is a good fit for covering those liabilities.

‍