Business Insurance: What It Actually Covers (and Doesn't)

The most common mistake founders make with insurance isn't failing to buy it. It's assuming that having a policy means they're covered for whatever happens. In reality, a policy only covers what its specific terms say it covers, matched against the specific business activities you disclosed when you bought it.

Why this distinction matters so much: if your actual operations don't match what the insurer was told (you added a new service line, you started handling more sensitive data, you began operating in a way that falls under a different risk classification), a claim tied to that undisclosed activity can be denied, even though you've been faithfully paying premiums the whole time. "Getting insurance" is the easy part. Making sure it actually covers what your business does is the part that requires ongoing attention.

When you buy a policy, the premium you pay is calculated from an estimate: your projected payroll, projected revenue, and the specific business classification code that best describes what you do. That estimate is only accurate if what you actually do matches what you told the insurer.

If your business adds a new activity that falls under a different risk classification (a software company that starts offering hands-on implementation services, a retailer that adds a delivery fleet, a consultancy that starts handling clients' sensitive financial data) and you don't update your policy, you may find that a claim tied to that new activity isn't covered at all, because it was never part of what the insurer agreed to underwrite. This is the single most common way founders discover, at the worst possible moment, that "having insurance" and "being covered" aren't the same thing.

For general liability and workers' compensation policies especially, most insurers run an annual premium audit: a reconciliation between the estimated payroll, revenue, and subcontractor costs your premium was based on, and what actually happened over the policy year. You'll typically need to provide payroll reports, tax documents, and check registers to verify it.

Why this matters beyond just the bill: the audit is effectively your evidence trail that what you told the insurer matches your real operations. Two of the most common audit surprises are worth planning for specifically: misclassified work: if you don't keep records showing which employees' time went to which job classification, the insurer is allowed to assign the employee's entire payroll to the highest-rated (most expensive) classification that applies to any part of their work. And uninsured subcontractors: if a subcontractor you paid can't show their own proof of general liability coverage (a Certificate of Insurance), the carrier often treats what you paid them as part of your payroll exposure, which can significantly increase your bill. Keeping clean records on both fronts, throughout the year rather than scrambling at audit time, avoids the most common source of a surprise post-audit bill.