Risk Management Before Insurance: Why Due Diligence is the First Step Towards Better Protection

Oct 14

11 min read

MWB Global Risks' Global Intelligence Digest: Trends, Developments, and Risks Shaping Today's Market

Risk Management Before Insurance: Why Due Diligence is the First Step Towards Better Protection

This document is for informational purposes only and is not intended to be exhaustive. No discussions or opinions in this document should be inferred as legal advice. Contact MWB Global Risks for insurance advice customized to your business needs. MWB Global Risks Inc. does not accept responsibility for the content of the information provided or any actions made on the basis of the information herein.

Download your own copy of this document below

Risk Management Before Insurance: Why Due Diligence is the First Step Towards Better Protection

Insurance is a hugely important part of protecting an organization, but effective protection starts long before the policy begins.

Insurance is about protecting the risks and exposures that exist within an organization; however, the more risk that exists, the higher your insurance premiums will be. That’s why risk management comes before the policy; the more effectively the organization manages their risks and exposures before placement, the more they will save on their insurance overall. And one of the most important phases of a risk management strategy is due diligence.

Before diving into the importance of risk management, let’s take a look at two different organizations with two different risk goals.

EXAMPLE SCENARIO

Nokia vs. Ericsson: Same Event, Two Different Outcomes

Background:

In March of 2000, a fire occurred at a Philips semiconductor plant in Albuquerque, New Mexico. Philips supplied critical mobile-phone chips to both Nokia and Ericsson. Although the fire itself was relatively small, smoke and contamination disrupted chip production for months. Both organizations suffered a loss, however, one organization had a strategy to combat the risk, while another did not.

Company A: Nokia

Founded in Finland in 1865, Nokia evolved from an industrial company into a major telecommunications manufacturer. By 1998, it had become the world’s largest mobile-phone manufacturer, a position it would hold for more than a decade. By 2000, Nokia was one of the dominant players in a rapidly expanding global mobile-phone market, making the reliability of its semiconductor supply chain critical to maintaining production.

Company B: Ericsson

Founded in Stockholm, Sweden, in 1876, Ericsson grew from a small telegraph-repair workshop into one of the world's major telecommunications companies. It played an important role in the development of mobile communications, including GSM technology, and by 2000 had become the world's leading supplier of 3G mobile systems. At the time, Ericsson manufactured both telecommunications infrastructure and mobile phones.

Impacts on Nokia & Ericsson

Comparing the Loss

Interestingly, while Philips themselves recorded losses in the millions and Ericsson reported a combined loss in the billions, Nokia not only experienced zero loss, but they upped their market share and increased profitability in both sales and operations. How was this possible? How did one fire result in two very different outcomes?

	PHILIPS	NOKIA	ERICSSON
TOTAL DISRUPTION	6 weeks to resume production; more than 9 months for full recovery. Most significantly, the 200-mm wafer fabrication line was shut down for more than one month.	None	Severe shipment delays, discounted products, excess and obsolete inventory write-offs, and supplier-contract renegotiations followed the component shortages.
TOTAL COST	$40 million in physical damage; $39 million insurance claim	None	$7 million in mobile production shortfall; total of $4.5 billion loss for the year 2000
LONG-TERM IMPACT	$40 million loss in chip sales as production fell to zero for over 6 weeks.	Market share increased by 30%, profits rose by 42% in 2000, €21.887 billion in 2000 net sales and €4.879 billion in operating profit.	At the time of the fire, Ericsson was already experiencing loss due to rising competition; recording a total of $15.6 billion in operating losses for the year 2000 (which was a combination of market competition and their ineffective risk management strategy), ultimately pushing the company to restructure in 2001.

How & Why Nokia Weathered the Disruption While Ericsson Did Not

So, how is it that the one fire which caused significant losses for one company, while another company relying on the same products not only experienced no loss, but actually increased profitability? What was the differentiator between Nokia and Ericsson that created this large gap?

Risk Strategy & Due Diligence.

When the fire intially ocurred, Philips informed their customers that the disruption to production would last only a week; Ericsson accepted this response while Nokia did not.

Ericsson's Response:

Ericsson initially accepted Philips’ early estimate that the disruption would last approximately one week and did not immediately escalate the incident as a major supply-chain threat. As the extent of the contamination became clearer, Ericsson discovered that production would be affected far longer than anticipated.

With no readily available alternative source for certain critical components, its options were limited by the time the full severity of the disruption was revealed, leaving the company significantly exposed to production delays and component shortages.

Nokia's Response:

Nokia, on the other hand, responded much more proactively. Although Philips initially estimated the disruption would last only one week, Nokia immediately placed the affected components on a “special watch,” with daily communication between Nokia and Philips engineers.

As it became clear that the disruption was more serious, Nokia activated its crisis plan, assembled a cross-functional response team, secured production capacity from other Philips facilities, identified alternative suppliers, and redesigned certain components so they could be sourced elsewhere.

This rapid response allowed Nokia to avoid a reported loss of mobile-phone production despite the disruption.

Planning for the Crisis Before The Crisis

The biggest differentiator between Ericsson and Nokia was that Nokia had a fully developed and established risk management strategy - which included procedures to follow in the event that one of their critical suppliers went down.

Ericsson did not.

It wasn’t simply that one company was able to predict the fire while the other company was not; the difference was that one organization had an in-depth understanding of their risks and exposures, visibility into their supply chain, previously-established alternative sourcing, and previously-defined escalation procedures - while the other did not.

Setting the Foundation Before Structuring the Policy

Building the Risk Strategy & Why it's Crucial

As mentioned, securing an insurance policy is the last of many steps. Insurance coverage, capacity, terms, and premiums are influenced by an organization’s risk profile; the greater the exposure, the more challenging and costly certain risks may be to insure.

Setting the Foundation Before Structuring the Policy

That is why risk management comes before insurance. Risk management is the practice of identifying, assessing, eliminating, mitigating, retaining, and transferring risk based on an organization’s exposures and objectives.

And the only way to do that is through an in-depth risk management analysis.

The Risk Management Identification Process

As risk identification forms the foundation of the overall risk strategy, a thorough, systematic process is used to ensure relevant exposures, vulnerabilities, dependencies, and potential sources of loss are identified and understood. This includes:

Understanding the organization as a whole
Mapping critical assets and dependencies
Identify threats and hazards
Identify vulnerabilities
Define risk scenarios
Identify potential consequences

The effectiveness of risk identification is determined not simply by the risks identified, but by the depth of understanding behind them.

Due diligence provides that depth.

Risk extends across every aspect of an organization; from financial to operational to technological to legal to political to reputational, to name a few. Understanding where risk exists across these dimensions requires risk managers to ask targeted questions designed to uncover exposures, dependencies, gaps, and vulnerabilities that may not be immediately apparent.

Some types of these questions include:

What could go wrong?
Where are we most vulnerable?
What/who do we depend on for day-to-day operations?
Where are the single points of failure?

Identifying a gap or vulnerability during this process would then lead to due diligence. For example: You’ve identified that one of your products is reliant on one single supplier. The follow up question would then be: If that supplier goes down, what will that mean for our business?

In doing this, a vulnerability has been identified. However, the follow-up questions would consist of:

How much inventory do we have?
How long could we operate without another shipment?
Does the supplier manufacture the component at multiple facilities?
Does the supplier have its own business continuity plan?
Are alternative suppliers available?

Due Diligence: Looking Beyond the Risk

The process of asking these follow up questions - determining how the organization would and could handle their main supplier ceasing operations is called Due Diligence.

In essence, identification finds the exposure, due diligence investigate it.

Due diligence is the systematic process of investigating and verifying an identified exposure to establish the facts needed to understand its significance and make an informed risk decision.

Using Nokia as an example, once the risk-identification process revealed “we depend on Philips for a critical semiconductor,” due diligence would examine that dependency in greater detail to understand the extent of the exposure, the potential consequences if Philips could no longer supply the component, and whether alternative suppliers existed that could provide the same or a suitable replacement component.

Due diligence was critical to Nokia’s ability to withstand the Philips fire. Had Nokia not investigated its supplier dependencies, understood the potential consequences of a disruption, and identified alternative sources of supply, it could have faced the same severe production losses that ultimately affected Ericsson.

The Value of Due Diligence in Underwriting

The value of due diligence extends beyond identifying and addressing vulnerabilities. What an organization learns through this process, and more importantly, the actions it takes in response, can directly influence its overall risk profile.

In Nokia’s case, Identifying its dependence on a critical supplier did not make the company less risky. Investigating that dependency did not eliminate the exposure either.

It was Nokia’s ability to use that information to strengthen contingency planning, establish alternatives, and reduce the potential impact of a disruption that made the difference.

This becomes particularly important when the organization eventually enters the insurance market. An underwriter is tasked with evaluating the risks an insurer is being asked to assume. Evidence that an organization understands its exposures, has investigated critical vulnerabilities, and has implemented appropriate controls provides the underwriter with valuable information when assessing that risk.

In other words, due diligence does more than uncover risk. It provides the information needed to manage it, demonstrate how it is being managed, and present a more complete risk profile to the insurance market.

Only after those risks have been identified, investigated, assessed, and appropriately managed can the organization determine which remaining exposures should be transferred through insurance.

Stronger risk management begins with thorough due diligence

Securing the Insurance Policy: The Final Step

Earlier, it was mentioned that building a risk management strategy involves identifying, assessing, eliminating, mitigating, retaining, and transferring risk based on an organization’s exposures and objectives.

Only once those steps have been thoroughly completed, is when an organization is able to see a clearer picture of the unavoidable risks they carry. This is when an organization would begin considering appropriate coverage types, limits, deductibles/retentions, program struction, and so on.

At its most basic, insurance is a form of risk transfer. It allows an organization to transfer certain financial consequences of an identified risk to an insurer in exchange for a premium. But before that transfer can take place effectively, the organization must first understand what it is asking the insurer to assume.

By this stage, the organization has already done much of the work that will inform the insurance program. It has identified its exposures, investigated critical vulnerabilities through due diligence, assessed their potential impact, implemented measures to reduce or control them, and determined what risk remains.

That remaining exposure, often referred to as residual risk, helps shape the conversation around what should be retained and what should be transferred through insurance.

This is why purchasing insurance should not be viewed as the beginning of the risk management process. The policy is the culmination of the work that comes before it.

The information gathered throughout that process provides brokers and underwriters with a more complete understanding of the organization’s risk. It can help inform coverage requirements, limits, deductibles, policy structure, risk controls, and ultimately, the terms under which an insurer is prepared to assume that risk.

Without that foundation, an organization risks approaching the insurance market without a complete understanding of what needs to be protected, where its greatest exposures lie, or whether certain risks could have been reduced before they were ever presented to an insurer.

Insurance is not the be-all, end-all; it is a tool that risk managers can use to address the remaining risk (i.e.: the risk that could not be fixed, mitigated, or transferred).

Where Risk Management Meets Insurance

That remaining exposure, often referred to as residual risk, helps shape the conversation around what should be retained and what should be transferred through insurance.

This is why purchasing insurance should not be viewed as the beginning of the risk management process. The policy is the culmination of the work that comes before it.

The information gathered throughout this process provides brokers and underwriters with a more complete understanding of the organization’s risk and can help inform coverage requirements, limits, deductibles, program structure, risk controls, and underwriting terms.

From Risk to Insurance

Risk management and insurance are not separate processes. Insurance is one component of a broader strategy designed to understand, manage, and respond to the risks an organization faces.

Once risks have been identified and investigated through due diligence, the organization can determine what can be avoided, reduced, or controlled, and what risk will remain.

Those remaining exposures can then be evaluated to determine what should be retained and what should be transferred through insurance.

Risk identification tells an organization what could go wrong. Due diligence determines what that could mean.

Risk management determines what can be done about it. Insurance helps address the financial consequences of the risk that remains.

Turning Insight into Action

The better an organization understands its risks, the better positioned it is to manage them. Due diligence helps uncover vulnerabilities, examine existing controls, and identify opportunities to reduce the likelihood or potential severity of a loss.

Identifying those opportunities, however, is only part of the process. The actions taken in response are what can change the organization’s risk profile. A single-source dependency, for example, may lead to alternative sourcing, increased inventory reserves, or stronger business continuity planning.

The objective is not to eliminate every risk, but to determine which risks can be avoided, reduced or controlled, retained, and transferred.

This becomes particularly important when approaching the insurance market. Demonstrating an understanding of key exposures and the measures taken to manage them gives brokers and underwriters a clearer picture of the risk being presented and may contribute to more favourable pricing, capacity, terms, and coverage.

By the time an insurance policy is structured and secured, much of the most important work should have already happened.

From Risk Management to Risk Transfer

This is where the role of the insurance broker becomes particularly important.

An effective insurance program should reflect the organization behind it: its operations, exposures, risk tolerance, existing controls, and the risks that remain after reasonable mitigation measures have been implemented.

The broker’s role is therefore not limited to obtaining quotes or placing a policy. It is to understand the organization’s risk profile, help determine which exposures require financial protection, translate those exposures into an appropriate insurance strategy, and present the risk effectively to the insurance market.

This requires bringing together the information gathered throughout the risk management process and determining how it should influence the insurance program. The nature and severity of the remaining exposures can help inform decisions around coverage, limits, deductibles, policy structure, and the amount of risk the organization is prepared to retain.

The broker also serves as the connection between the organization and the insurance market. A thorough understanding of the risk allows the broker to communicate the organization’s exposures, controls, and risk management measures to underwriters, while evaluating how available insurance solutions respond to those exposures.

This process can reveal where coverage is needed, where gaps may exist, and where the insurance program should be structured differently to reflect the organization’s actual risk profile. It also helps ensure that decisions around risk transfer are made with a clear understanding of what is being protected, what remains exposed, and why.

That connection between risk management and risk transfer is what allows insurance to become part of the organization’s broader risk strategy, rather than a standalone purchase.

Connect with MWB Global Risks to explore a more integrated approach to risk management and insurance.

Get the MWB Difference

Need Help?

Connect with MWB Global Risks to explore insurance and risk management solutions designed around the realities of your business.

MWB Global Risks is a boutique insurance and risk management brokerage specializing in domestic and multinational risk solutions for mid-sized to large organizations operating in increasingly complex environments.

Backed by 100+ years of combined industry experience, our team provides tailored guidance, technical expertise, and coordinated program execution across jurisdictions and industries.

Our approach is built on long-term relationships, responsive service, and a deep understanding of how insurance programs must perform both at placement and at the time of loss.

From multinational insurance structures to complex corporate risk strategies, we help organizations remain resilient, compliant, and prepared for growth in an evolving global landscape.