Insurance As A Balance Sheet Risk: What Canadian Controllers and CFOs need to review annually
Executive Summary: Insurance should be reviewed annually as part of risk-financing architecture, not a commodity renewal. For Canadian Controllers and CFOs, the real questions are not just premium and limits. They are how much volatility the balance sheet is retaining, how quickly recoveries can be recognized and collected, whether deductibles and self-insured layers still fit the company’s liquidity profile, and whether core coverages such as property, business interruption, D&O, cyber, crime, and contractual risk transfer still reflect the business as it exists today.
Key takeaways
- Insurance is not just a transfer-of-risk product. It is a balance sheet protection and capital allocation decision.
- A company can be technically insured and still face material earnings volatility, cash flow strain, delayed recovery, and covenant pressure.
- Under IFRS and U.S. GAAP, losses and insurance recoveries are not always recognized at the same time.
- Deductibles, self-insured retentions, and captives should be evaluated the same way finance leaders evaluate any other use of capital.
- A serious annual insurance review should be led jointly by finance, operations, legal, HR, and IT, not delegated to renewal admin alone.
- The better management question is not “What did premium do?” It is “What is our total cost of risk, and is the structure improving resilience or quietly increasing volatility?”
Insurance is a balance sheet issue, not just an insurance line item
For many companies, insurance is still handled like an annual procurement event. That is a mistake.
From a CFO or Controller perspective, insurance is better understood as a risk-financing system that determines where loss lands when the business gets hit. If the program is well designed, it reduces volatility, preserves liquidity, supports lender confidence, and shortens recovery time. If it is poorly designed, it can magnify financial stress even when policies exist.
That distinction matters because losses rarely arrive in a clean, insured, immediately reimbursed format.
Why finance leaders should care
When a major event occurs, the financial impact usually appears in stages:
-
The loss hits first
- Cash often leaves before recovery arrives.
- Cleanup, legal, forensic, replacement, payroll continuity, customer remediation, and operational disruption can all create immediate spend.
-
The company may be retaining more risk than management realizes
- Deductibles
- Self-insured retentions
- Sublimits
- Waiting periods
- Exclusions
- Co-insurance mechanics
- Outdated values
- Contractual assumptions
- Claim disputes
-
Timing matters as much as limit
- A large policy limit can still fail to protect liquidity if recovery is delayed or if values, wording, or documentation do not support the claim.
-
Boards and lenders care about resilience, not just policy count
- Insurance gaps and delayed recoveries can affect EBITDA, borrowing capacity, acquisition plans, debt covenants, and management credibility.
That is why insurance belongs inside the same conversation as treasury, forecasting, continuity planning, and ERM.
Insurance is a risk-financing and risk management decision
A CFO-led insurance review should ask one question before all others:
Which risks should we retain, and which should we transfer, given our liquidity, volatility tolerance, growth plans, and downside exposure?
That is fundamentally a finance question.
Most management teams have four broad choices for any risk:
- Avoid it
- Reduce it
- Retain it
- Transfer it
The mistake is not always retaining too much. Often, it is retaining risk by default rather than by design.
IFRS vs U.S. GAAP: why accounting treatment matters after a loss
Controllers and CFOs also need to understand that an insured loss and an expected insurance recovery do not always move through the financial statements at the same time.
Under IFRS
Under IFRS, reimbursements related to a recognized provision are generally recognized only when receipt is virtually certain, and they are recognized as a separate asset, not simply netted against the loss.
Business interruption treatment can be different. Lost profits do not automatically create a provision, so recognition depends on whether the company has an unconditional right to compensation.
Under U.S. GAAP
Under U.S. GAAP, loss contingencies are accrued when they are probable and reasonably estimable. Recoveries of recognized losses can often be recognized earlier than pure gain contingencies, but recoveries that exceed recognized losses are typically subject to the gain contingency framework and are not recognized until realized or realizable.
Why this matters in practice
If management assumes “the insurer will pay, so the loss will wash through,” finance can end up overstating near-term recovery and understating volatility.
That can distort:
- monthly close expectations
- lender conversations
- board reporting
- quarter-end forecasts
- covenant modeling
- restructuring or impairment decisions
IFRS vs U.S. GAAP at a glance
| Issue | IFRS | U.S. GAAP |
|---|---|---|
| Loss recognition | Provision recognized when criteria are met | Loss contingency accrued when probable and reasonably estimable |
| Recovery threshold | Reimbursement generally recognized only when virtually certain | Recovery of a recognized loss may be recognized when probable |
| Gain contingency treatment | Contingent assets generally not recognized until virtually certain | Gain contingencies generally not recognized until realized or realizable |
| Presentation | Recovery recognized separately | Depends on facts and framework, but gain-contingency discipline still matters |
| CFO implication | Recognition threshold can be later and more conservative | Split treatment can create timing differences between losses and recoveries |
Retained vs transferred risk is a capital allocation decision
- A deductible is not just a pricing lever.
- A self-insured retention is not just a policy feature.
- A captive is not just an insurance structure.
- All three are ways of deciding where capital sits when loss occurs.
Deductibles
Higher deductibles can lower premium and improve efficiency, but they also increase first-dollar cash exposure. That only makes sense if:
- the company can absorb expected frequency without stress
- the premium savings justify the added volatility
- claim patterns support the move
- management has deliberately approved the retained layer
Self-insured retentions
An SIR often shifts more responsibility to the insured at the beginning of a claim. That can affect:
- cash timing
- defense costs
- claims handling responsibility
- internal reporting burden
- dispute risk
For some organizations, that control is useful. For others, it quietly creates unmanaged operational drag.
Captives
Captives formalize self-insurance. In the right structure, they can improve control, create flexibility, and support a more deliberate retained-risk strategy. But they are not lightweight tools.
They involve:
- governance
- capital
- reserves
- reporting
- regulatory oversight
- administration
That means the right finance question is not “Can we build a captive?” It is:
“Is retaining this layer of risk inside a captive a better use of capital than transferring it to the market once we account for volatility, governance, and complexity?”
The commercial insurance lines finance leaders should understand
CFOs do not need to become underwriters. But they do need a working view of the lines that can materially affect financial outcomes.
Property insurance
Protects buildings, equipment, stock, contents, and other physical assets.
Finance focus:
- Statement of Values accuracy
- replacement cost vs actual cash value
- inflation adequacy
- co-insurance
- margin clauses
- unnamed location limitations
- equipment breakdown overlap
Business interruption and extra expense
Designed to protect income and continuity after an insured event.
Finance focus:
- business income worksheet quality
- indemnity period length
- waiting periods
- contingent business interruption
- service interruption
- single-site or supplier concentration
Commercial general liability and umbrella/excess
Protects against third-party bodily injury, property damage, and certain liability claims.
Finance focus:
- U.S. exposure
- products/completed operations
- contractual assumptions
- excess tower sufficiency
- defense-cost treatment
Directors and Officers liability
Protects the board, executives, and in some cases the organization against management liability claims.
Finance focus:
- limit adequacy
- EPL inclusion or separation
- lender and investor expectations
- M&A or governance complexity
- private company wording quality
Cyber insurance
Protects against first-party and third-party cyber losses.
Finance focus:
- business interruption triggers
- dependent business interruption
- ransomware response
- social engineering sublimits
- funds transfer fraud
- vendor panel requirements
- control representations in underwriting
Crime insurance
Protects against employee theft, fraud, forgery, and certain funds transfer losses.
Finance focus:
- treasury controls
- AP fraud
- impersonation/social engineering limits
- segregation of duties
- dual authorization
Environmental / pollution liability
Relevant where standard liability policies leave material pollution gaps.
Finance focus:
- storage and disposal practices
- site history
- contractual obligations
- lender and landlord requirements
Professional liability / E&O
Relevant where services, advice, design, or professional output can create financial loss claims.
Finance focus:
- claims-made structure
- retro dates
- contractual assumptions
- U.S. jurisdiction exposure
Marine cargo / stock throughput / transit
Important for importers, exporters, distributors, and businesses with meaningful goods-in-transit exposure.
Finance focus:
- Incoterms
- third-party warehousing
- high-value shipments
- global supply chain dependence
The annual insurance review checklist every CFO and Controller should run
A serious review should happen well before renewal, not when the market is already tight and options are shrinking.
A. Exposure and underwriting updates
- Confirm current legal entities and ownership structure
- Update revenue, payroll, headcount, and operations
- Add new locations, products, geographies, acquisitions, and contracts
- Refresh the Statement of Values annually
- Complete a current business interruption worksheet
- Reassess mobile assets, stock values, and foreign operations
- Review U.S. exposure separately if operations or sales have expanded
B. Claims and retained loss review
- Review 5 to 6 years of loss runs
- Separate frequency from severity
- Analyze open claims, reserves, and recovery bottlenecks
- Track near misses, not just paid claims
- Review whether claims handling is increasing retained cost
C. Retained risk review
- Map all deductibles and self-insured retentions by line
- Quantify realistic first-dollar cash exposure
- Compare premium savings to retained volatility
- Stress test one major loss plus one concurrent secondary event
- Decide whether current retentions are deliberate or accidental
D. Coverage adequacy review
- Property values
- BI values and indemnity periods
- Umbrella / excess limits
- D&O and EPL adequacy
- Cyber limits, sublimits, and exclusions
- Crime and social engineering limits
- Environmental, cargo, recall, and E&O needs where relevant
E. Contract risk transfer review
- Review customer, lender, landlord, and vendor insurance requirements
- Confirm additional insured obligations
- Confirm waiver of subrogation and primary/non-contributory wording where required
- Review indemnity clauses and hold harmless obligations
- Track vendor certificates of insurance systematically
F. Governance and finance review
- Align insurance review with budgeting and forecast timing
- Confirm accounting treatment assumptions for losses and recoveries
- Review debt covenant sensitivity to uninsured or delayed recoveries
- Confirm board reporting protocol for major coverage changes
- Set claim escalation procedures internally
G. Cyber and operational resilience review
- Validate MFA, backup, incident response, and fraud controls
- Review business continuity and disaster recovery plans
- Review key vendor concentration and cloud dependency
- Reassess treasury and AP fraud controls
H. Renewal process discipline
- Start early enough for true market leverage
- Require current underwriting data, not recycled submissions
- Review wording changes, exclusions, and sublimit reductions
- Compare structure and wording, not just premium
- Reduce renewal-date fragmentation where it creates inefficiency
A CFO dashboard concept: measuring Total Cost of Risk
Most finance teams can tell you total premium.
Fewer can tell you total cost of risk in a way that supports decision-making.
That is a missed opportunity.
A practical CFO dashboard should include:
Core TCOR measures
- total premium
- retained losses
- deductible and SIR spend
- uninsured losses
- advisory / broker / admin cost
- risk-control spend tied to insurable exposures
- external legal / forensic / vendor cost where material
Trend measures
- TCOR as % of revenue
- TCOR as % of EBITDA
- TCOR per employee
- 3-year and 5-year claims trend
- frequency vs severity mix
- top loss drivers by line
- average claim cycle time
Program-quality measures
- % of locations with refreshed values in the past 12 months
- % of policies renewed with updated underwriting data
- number of material coverage exceptions
- number of uncovered or partially covered loss events
- number of policies renewing on fragmented dates
- number of material wording changes flagged
Capital allocation measures
- retained layer by line
- modeled maximum retained loss by event
- premium saved from higher retentions
- volatility added per $1 of premium saved
- cost of downtime vs insured recovery timing
Where life insurance and group benefits fit into the picture
This is often left out of P&C conversations, but it should not be.
Key person life and disability insurance
If the loss of a founder, owner, key technical leader, lead salesperson, or senior executive would materially impair revenue, debt confidence, continuity, or succession, key person coverage can be a legitimate business continuity tool.
Strategic uses can include:
- replacement and recruiting cost
- transition liquidity
- buy-sell support
- lender comfort
- continuity protection for customers, investors, and employees
Employee group benefits
Group benefits are often treated separately from commercial insurance, but from a finance perspective they still matter because they affect:
- workforce continuity
- disability and absence risk
- retention pressure
- total compensation economics
- employee trust during disruption
- long-term cost trend
A mature annual review should at least ask:
- Are benefits costs being optimized or simply renewed?
- Are life, disability, and critical illness structures aligned with workforce concentration risk?
- Are there continuity gaps that would become expensive in a labor-constrained environment?
Insurance belongs inside ERM
Insurance is most valuable when it is clearly tied to enterprise risk decisions.
A practical ERM lens looks like this:
Avoid
Exit or redesign activities where risk-adjusted economics do not work.
Reduce
Use controls, training, cybersecurity, contractual discipline, and process design to reduce frequency and severity.
Retain
Keep risk where the business has the balance sheet strength and governance to absorb it rationally.
Transfer
Use insurance, indemnities, guarantees, and contractual transfer where downside exposure exceeds tolerance.
Monitor
Track claims, control drift, exposures, and whether the current structure still fits the business.
The mistake many companies make is transferring risk without measuring it first, or retaining risk without deciding to.
FAQ
Why should a CFO care about insurance beyond premium cost?
Because premium is only one part of the cost. Retained losses, exclusions, delayed recoveries, underinsurance, and operational disruption can have a much larger impact on earnings and liquidity.
How often should a company review its insurance program?
At minimum annually, and again after acquisitions, financing events, major contracts, U.S. expansion, leadership changes, or material operational shifts.
What is the difference between a deductible and a self-insured retention?
A deductible usually means the insurer remains involved and then recovers the deductible amount from the insured. A self-insured retention generally means the insured funds and manages that layer before the insurer responds.
Can insurance recoveries be recorded immediately after a loss?
Not always. Timing depends on the accounting framework, the nature of the loss, and the certainty of recovery.
What are the biggest insurance gaps for mid-market companies?
Common gaps include outdated property values, weak BI analysis, inadequate D&O, weak cyber structure, low crime / social engineering sublimits, poor contract risk transfer controls, and stale underwriting information.
Is cyber insurance a finance issue or an IT issue?
It is both. Cyber underwriting depends heavily on operational controls, but the financial consequences of an incident sit squarely with finance through cash flow, downtime, legal cost, and reporting impact.
When should a company consider a captive?
Usually only after it has strong claims data, sufficient scale, governance capacity, and a deliberate retained-risk strategy. A captive is not a substitute for weak underwriting data or poor internal controls.
Final thought
The annual insurance review should not be a premium negotiation exercise squeezed into the edge of quarter-end.
It should be a structured finance and risk review that answers a harder question:
If the business takes a real hit this year, have we actually financed that risk properly?
The companies that handle insurance well are not just buying policies.
They are making deliberate decisions about volatility, liquidity, recovery, and resilience.
How ALIGNED Insurance can help?
At ALIGNED, the right starting point is not a rushed renewal.
It is a disciplined review built around:
- Audit the current program, underwriting data, and retained-risk structure
- Optimize limits, wording, values, BI assumptions, and total cost of risk
- Execute with market validation, transparency, and year-round discipline