Click next to see how effectively private companies recognize and manage the biggest risks they face.

(All graphics on the following pages are from Chubb)

Private Company Misconception: GL Covers Everything

While private companies do express concerns regarding corporate risk, many are not adequately protected by insurance. This may be due to misconceptions surrounding what general-liability insurance covers and what it does not.

Over 50% of private-company decision makers responding to Chubb's survey do not purchase directors & officers liability coverage, EPLI, errors & omissions liability coverage and fiduciary liability insurance because they believe the associated risks are covered under a GL policy.

Chubb explains that GL covers incidents such as legal liability for claims involving bodily injury, property damage, advertising injury or personal injury; defense expenses for suits filed against the insured; cases of infringement upon another's copyrighted advertisement or registered trademark; publication of materian that violates a person's privacy or libels or slanders a person or organization; and personal injury.

Chubb notes that GL, however, does not cover financial injury from actual or alleged wrongdoings of a company's directors and officers; employment-related discrimination, harassment or retaliation; breach of fiduciary duty imposed by ERISA for an employee benefit fiduciary-liability claim; financial injury that may be insured by professional liability or product or service E&O liability policies; first-party expenses resulting from a privacy-data breach.

Employee Fraud Exposures

Smaller companies face a greater threat from employee fraud, Chubb says citing data from the Association of Certified Fraud Examiners. But just 30% of executives at small companies (<$5 million in revenue) say they are concerned about this risk, compared to 56% of executives at large companies (>$25 million in revenue).

In total, only 23% of private companies purchase crime insurance, including 47% of large companies and 17% of small companies.

Chubb says 25% of private companies are likely to be involved in a major acquisition or merger, or sell part of their business. This can increase the risk of theft if employees fell their jobs are jeopardized.

1. ACFE

D&O Lawsuits: They Can Impact Private Companies Too

Many private-company decision makers mistakenly believe they are insulated from directors and officers lawsuits because their company is not publicly traded. But Chubb says private companies carry nearly as much risk as public companies, and lawsuits can come from sources such as vendors, competitors, regulators and employees.

D&O lawsuits, says Chubb, can be costly as well, with the average coast reported to the Private Company Risk Survey being nearly $700,000.

As noted earlier, decision makers also mistakenly believe that D&O risks are covered under a GL policy. Tony Galban, global D&O product manager at Chubb, explains, “Let's say you make a drug which causes harm to people and that has to be recalled and taken off the shelf. The coverage that pays for the harm to the people would be GL insurance. The loss of monetary and reputational value of the company because of the recall would be addressed by a D&O liability policy.”

Fiduciary Liability: The Unseen Risk

Three quarters of private companies use outside service providers for employee benefit plans, but only a quarter purchase fiduciary liability insurance to insure managers who select and hire these service providers.

Just 26% of respondents purchased fiduciary-liability insurance; 72% of the non-buyers either believe the exposure is covered under their GL policy (51%) or don't know if it is covered under their GL policy (21%).

Chubb says companies may also not realize the potential exposure for their fiduciaries, or may be “confusing fiduciary-liability insurance with fiduciary-bond insurance—required by law—that protects the plan assets but not the fiduciaries.” Chubb says fiduciary liability “appears to be one of the most poorly understood of private-company risks.

Employment-Related Risks

All companies, even the best-run ones, are vulnerable to EPL charges because they engage in normal employment-related activities such as hiring, firing and promotions, Chubb says. Charges such as discrimination, sexual harassment, retaliation (the most common charge) and bullying may be brought by past, present or prospective employees.

Michael Schraer, global EPL product manager at Chubb, points out an emerging factor in EPL events: “We're seeing social media become more of an issue in employment during the hiring process, where the claimant comes in with emails, Facebook postings and all kinds of social-media-related evidence that can prove that [discrimination by the company] actually happened.”

Despite the risks, Chubb says only 30% of respondents purchase EPLI. Part of the reason, again, is that 60% believe their GL policy covers the risks.

E&O Risks: Even the Best Professionals Can Be Sued

The good news is that executives are more concerned about potential E&O lawsuits than in the past, according to Chubb. Still, most do not purchase E&O insurance, and, in fact, only 55% of companies that said they are contractually required to carry the coverage actually purchased it.

Chubb notes that any company that performs a professional service for others can be held accountable for its actions. Chubb says 49% of survey respondents fell into this category. Of those companies, 37% reported being concerned about an E&O lawsuit, compared to only 12% in Chubb's 2010 survey.

Cyber Risk: High Concern; Low Insurance Takeup

Former FBI Director Robert Mueller said in 2012, “There are only two types of companies: those that have been hacked, and those that will be. Even that is merging into one category: those that have been hacked and will be again.”

But hacking isn't the only cyber risk. Chubb notes that 59% of breaches involve human error or system problems. In fact, Chubb notes that a breach might be as simple as a lost laptop.

The Ponemon Institute in a 2013 study pointed out that the average cost of a cyber attack is $188 per compromised record. Despite the risks and the costs though, the vast majority of companies surveyed by Chubb did not purchase cyber insurance, and 57% say they do not have an incident-response plan. Chubb says an incident-response plan can reduce notification costs by up to $42 per record.

Workplace Violence: No Employer Is Immune

There were 13,827 workplace homicides from 1992 to 2010, Chubb says, and in 2009, 1,527 nonfatal violent crimes occurred every day against persons 16 or older while at work.

Chubb says concern among private-company decision makers is rising—29% of respondents versus 8% in 2010.

The average total reported losses associated with workplace violence was $65,664, says Chubb.