For insurers, underwriting commercial crime insurance involves evaluating how an organization handles money, financial records, payment instructions, sensitive information, and access to valuable assets. The assessment considers the likelihood of fraud, potential financial consequences, internal control effectiveness, and the organization's ability to detect and respond to suspicious activity.

Businesses face different crime exposures depending on their size, industry, transaction volume, workforce structure, technology environment, and financial processes. A company with centralized payment approvals may have a different risk profile from an organization with decentralized treasury operations or extensive third-party payment activity.

A structured underwriting review helps insurers understand these exposures and evaluate the policy terms, limits, deductibles, exclusions, and conditions that may be appropriate for the organization.

Importance of Commercial Crime Insurance Underwriting

Commercial crime underwriting helps insurers assess the financial risks associated with dishonest acts and identify the controls that may reduce potential losses.

A comprehensive assessment can help:

• Evaluate employee fraud exposure: Review access to cash, financial records, inventory, and payment systems.

• Assess funds transfer risks: Examine payment authorization procedures, banking controls, and verification practices.

• Measure internal control effectiveness: Understand how organizations prevent, detect, and investigate suspicious activity.

• Identify financial vulnerabilities: Review transaction concentration, approval weaknesses, and segregation of duties.

• Evaluate potential loss severity: Estimate the financial consequences of different fraud scenarios.

• Determine appropriate policy terms: Assess limits, deductibles, coverage extensions, and relevant exclusions.

• Support risk improvement: Identify control weaknesses that may require attention before or during policy placement.

Underwriting is not limited to reviewing the amount of money a company handles. It also considers how financial transactions are authorized, recorded, monitored, and reconciled.

Understanding Commercial Crime Insurance Coverage

Commercial crime policies can address different categories of dishonest or fraudulent activity. Coverage varies significantly between insurers and policy forms, so individual definitions and conditions must be reviewed carefully.

Employee Dishonesty

Employee dishonesty coverage generally addresses specified losses resulting from dishonest acts committed by employees with the intention of causing financial harm or obtaining an improper benefit.

Potential exposure areas include:

• Theft of company funds.

• Unauthorized payments.

• Misappropriation of inventory.

• Falsification of financial records.

• Manipulation of accounting entries.

• Unauthorized use of corporate assets.

Underwriters may examine employee access privileges, financial approval limits, background screening practices where lawful, internal reporting procedures, and independent review arrangements.

The policy definition of an employee and the requirements for establishing a covered dishonest act are particularly important.

Forgery and Alteration

Forgery and alteration coverage may address specified financial losses involving forged or altered instruments, documents, or payment instructions.

Examples of potential exposure include altered payment records, forged financial instruments, or fraudulent changes to documents used in financial transactions.

Underwriters may review cheque controls, signature verification, document authentication, payment reconciliation, and the handling of sensitive financial records.

Funds Transfer Fraud

Funds transfer fraud involves unauthorized instructions that cause money to move from an organization's account to another account.

This exposure may arise through compromised communication channels, impersonation, manipulated payment instructions, or unauthorized access to financial systems.

Underwriting considerations include:

• Verification of new or changed beneficiary details.

• Independent confirmation of unusual transfer requests.

• Multi-person approval for significant payments.

• Access restrictions for banking platforms.

• Monitoring of unusual transaction patterns.

• Procedures for reporting suspicious payment activity.

The exact policy treatment of fraudulent transfer instructions, social engineering, and cyber-enabled deception depends on the wording and any applicable endorsements.

Computer and Electronic Crime

Computer-related crime coverage may address certain losses resulting from unauthorized computer activity or fraudulent manipulation of electronic systems.

Potential scenarios include unauthorized electronic transactions, manipulation of financial information, or specified fraudulent access to business systems.

Underwriters should distinguish between traditional commercial crime exposures and broader cyber risks. A cyber insurance policy may address different incident costs and liabilities, while a crime policy may respond to specific direct financial losses. The policies should be reviewed together to identify potential gaps or overlaps.

Third-Party and Client Property Exposure

Some businesses handle funds, securities, or property belonging to customers, vendors, or other third parties.

The underwriting review should establish whether the organization has responsibility for these assets and whether the policy wording extends to the relevant property or financial interests.

Coverage may depend on custody arrangements, contractual obligations, ownership definitions, and applicable policy conditions.

Employee Fraud Exposure Assessment

Employee-related fraud is a significant consideration in commercial crime underwriting because employees may have legitimate access to financial systems, sensitive information, and company assets.

Employee Access and Responsibilities

Underwriters may review which employees can:

• Initiate financial transactions.

• Approve payments.

• Modify vendor banking information.

• Access payroll records.

• Change accounting entries.

• Handle cash or inventory.

• Create or modify customer accounts.

• Reconcile financial statements.

The greater the concentration of sensitive responsibilities within one individual, the more important independent oversight becomes.

Segregation of Duties

Segregation of duties separates important financial responsibilities among different individuals.

For example, the person who creates a vendor record should not automatically have unrestricted authority to approve payments to that vendor.

Effective separation can reduce the opportunity for a single employee to initiate, authorize, execute, and conceal a fraudulent transaction.

Underwriters may examine whether these controls operate consistently across all business locations and subsidiaries.

Employee Turnover and Temporary Access

Workforce changes can create additional control challenges.

Underwriters may review procedures for:

• Removing access when employees leave.

• Updating permissions after role changes.

• Monitoring temporary or contractor accounts.

• Reviewing privileged user activity.

• Restricting access to financial systems.

• Investigating unusual access after employment changes.

Inactive accounts and excessive privileges can create opportunities for unauthorized financial activity.

Fraud Awareness and Reporting

Employee awareness programs can help individuals recognize suspicious requests, impersonation attempts, and unusual payment instructions.

Organizations should also maintain confidential reporting channels and clear escalation procedures so that suspected misconduct can be reported and investigated appropriately.

Funds Transfer and Payment Fraud Underwriting

Electronic payment processes create important underwriting considerations because fraudulent instructions can lead to substantial financial losses.

Business Email Compromise

Business email compromise involves deception through compromised or impersonated business email accounts. Criminals may attempt to persuade employees to change payment details, transfer funds, or disclose sensitive financial information.

Underwriters may ask whether organizations use independent verification for payment changes and unusual instructions.

Email security controls can help reduce exposure, but payment verification should not depend solely on the authenticity of an email account.

Vendor and Beneficiary Changes

Fraudulent changes to supplier bank details can redirect legitimate payments to unauthorized accounts.

Organizations should establish documented procedures for validating changes to vendor information.

Useful controls include independent confirmation through previously verified contact details, restricted access to vendor records, approval workflows, and audit trails.

Wire and Electronic Payment Controls

Payment controls may include:

• Dual authorization for significant transfers.

• Transaction limits.

• Separate initiation and approval permissions.

• Multi-factor authentication.

• Bank account monitoring.

• Alerts for unusual payment activity.

• Periodic access reviews.

• Independent reconciliation.

Underwriters may assess whether these controls are documented, consistently applied, and tested.

Emergency and Out-of-Process Payments

Fraudsters may exploit urgent requests or exceptions to normal approval procedures.

Organizations should define how emergency payments are authorized and verified. Exceptions should be documented and reviewed after execution.

A control framework that is regularly bypassed may provide less protection than its written policy suggests.

Internal Controls and Fraud Prevention

Internal controls are central to commercial crime underwriting because they influence both the likelihood of fraud and the organization's ability to identify losses.

Financial Authorization Policies

Organizations should establish clear approval limits based on transaction value, risk, and responsibility.

High-value payments, unusual transactions, and changes to sensitive financial records may require additional authorization.

Underwriters may request evidence that approval limits are reviewed periodically and that system permissions reflect current responsibilities.

Independent Reconciliation

Reconciliation compares financial records with independent information, such as bank statements or supporting transaction documentation.

Regular reconciliation can help identify unauthorized payments, unexplained differences, duplicate transactions, and suspicious account activity.

The person performing the reconciliation should be sufficiently independent from the individuals initiating and approving the transactions.

Access Management

Financial systems should provide access according to business responsibilities.

Useful controls include:

• Role-based permissions.

• Multi-factor authentication.

• Privileged access monitoring.

• Periodic access certification.

• Prompt removal of unnecessary permissions.

• Logging of sensitive account activity.

Access reviews should cover financial applications, banking platforms, payment gateways, and other systems that can affect company funds.

Internal Audit and Control Testing

Internal audit functions can evaluate whether financial controls are appropriately designed and operating as intended.

Testing may include payment approval reviews, vendor record checks, reconciliation procedures, user access assessments, and examination of unusual transactions.

Documented findings and corrective actions can provide useful evidence during underwriting reviews.

Commercial Crime Insurance Underwriting Process

An underwriting assessment typically combines information about the applicant, its financial activities, fraud controls, loss history, and requested policy terms.

Business and Operational Profile

Insurers may examine:

• Industry and business activities.

• Annual revenue and transaction volumes.

• Number of employees.

• Geographic operations.

• Subsidiary and branch structures.

• Cash handling activities.

• Third-party funds managed.

• Banking and payment arrangements.

This information helps establish the organization's overall financial crime exposure.

Financial Exposure Analysis

Underwriters may evaluate the maximum amounts that could be lost through different fraud scenarios.

Relevant considerations include:

• Maximum funds held in accounts.

• Typical and maximum payment values.

• Payroll exposure.

• Inventory and asset values.

• Vendor payment concentration.

• Number of authorized banking users.

• Potential exposure across subsidiaries.

The analysis should consider both individual transactions and the possibility of multiple related fraudulent activities.

Claims and Loss History

Previous fraud incidents can help underwriters understand an organization's exposure and control environment.

Insurers may request information about:

• Previous employee dishonesty incidents.

• Unauthorized payment losses.

• Forgery or alteration events.

• Funds transfer fraud.

• Internal investigations.

• Recoveries and unresolved claims.

• Corrective measures implemented after incidents.

A previous loss does not necessarily determine future insurability. The circumstances, financial impact, control weaknesses, and corrective actions are all relevant.

Underwriting Questionnaire and Supporting Records

Applicants may be asked to complete questionnaires and provide supporting documentation.

Common information includes:

• Financial statements.

• Organization charts.

• Employee access policies.

• Payment authorization procedures.

• Banking controls.

• Internal audit findings.

• Fraud prevention policies.

• Previous insurance claims.

• Details of existing crime and cyber policies.

Information should be complete and consistent. Material omissions or inaccurate representations can create problems during policy placement or a later claim.

Policy Evaluation: Limits, Deductibles, and Exclusions

A commercial crime policy should be evaluated against the organization's actual financial exposures and the wording of the available coverage.

Policy Limits

The policy limit represents the maximum amount payable for covered losses, subject to the policy's terms and any applicable sublimits.

Organizations should consider whether the requested limit reflects:

• Potential employee dishonesty losses.

• Maximum funds transfer exposure.

• Cash and securities exposure.

• Number of operating entities.

• Financial transaction concentration.

• Applicable sublimits for specific coverage sections.

A single overall limit may not provide the same protection across every coverage category.

Deductibles and Retentions

Deductibles or retentions determine the portion of an eligible loss that remains with the insured.

The financial impact should be assessed against the organization's ability to absorb losses and its overall risk financing approach.

Exclusions and Coverage Conditions

Exclusions can materially affect the scope of protection.

Depending on the policy, relevant provisions may address:

• Certain dishonest acts.

• Unauthorized electronic transactions.

• Social engineering.

• Losses involving third-party property.

• Indirect or consequential financial losses.

• Prior known incidents.

• Contractual liability.

• Losses discovered outside specified conditions.

Organizations should review definitions, exclusions, discovery provisions, reporting requirements, and other conditions rather than relying only on the policy title.

Discovery and Reporting Requirements

Crime policies may contain specific provisions governing when a loss must be discovered and reported.

The organization should understand the applicable reporting process, required documentation, and responsibilities for notifying the insurer.

Delayed reporting or incomplete records can complicate claim evaluation.

Coordination with Other Policies

Commercial crime, cyber, professional liability, and financial institution policies may address different aspects of a single incident.

For example, a fraudulent transfer may involve direct financial loss, a compromised email account, and investigation expenses.

Organizations should review how the relevant policies interact, including exclusions and other insurance provisions, to identify potential coverage gaps.

Common Underwriting Challenges and Warning Signs

Certain conditions may require additional underwriting attention.

Weak payment verification: Payment instructions can be changed without independent confirmation.

Excessive user privileges: Employees retain access beyond their current responsibilities.

Inadequate reconciliation: Financial differences remain unresolved or are reviewed by individuals involved in the original transactions.

High employee concentration: One individual controls several critical financial functions.

Unmonitored subsidiaries: Smaller entities operate with less oversight than the corporate headquarters.

Repeated control exceptions: Documented approval procedures are frequently bypassed.

Incomplete loss records: Previous incidents have not been fully documented or reviewed.

Unclear policy wording: Important fraud scenarios are not clearly addressed by the proposed coverage.

Organizations should address material weaknesses and provide accurate information during the underwriting process.

Commercial Crime Insurance Underwriting Checklist

Use this checklist when preparing for a commercial crime insurance review:

• Document business activities and financial transaction volumes.

• Identify employees with access to funds and financial systems.

• Review segregation of duties across payment processes.

• Evaluate vendor and beneficiary change controls.

• Verify dual approval requirements for significant transfers.

• Review access permissions for banking and accounting platforms.

• Assess independent reconciliation procedures.

• Document previous fraud incidents and corrective actions.

• Review internal audit findings and control testing.

• Estimate potential financial loss scenarios.

• Compare requested limits with relevant exposure categories.

• Review deductibles, sublimits, exclusions, and policy conditions.

• Examine discovery and reporting requirements.

• Coordinate crime coverage with cyber and other relevant policies.

• Retain underwriting submissions and supporting documentation.

Tools and Resources

Organizations and underwriting teams may use several resources to assess commercial crime exposure:

• Fraud risk assessment frameworks: Help identify employee, payment, vendor, and financial process vulnerabilities.

• Enterprise resource planning systems: Provide transaction records, approval workflows, and financial audit trails.

• Identity and access management platforms: Support access reviews and control over financial system permissions.

• Banking security tools: Provide transaction alerts, authentication controls, and payment monitoring.

• Internal audit programs: Evaluate whether financial controls are properly designed and consistently applied.

• Claims management records: Support analysis of previous incidents, loss patterns, and corrective actions.

• Insurance policy comparison documents: Help evaluate definitions, coverage limits, exclusions, and reporting conditions.

• Professional underwriting guidance: Supports consistent assessment of financial crime exposures and policy structure.

Tools should be selected according to the organization's size, transaction complexity, technology environment, and risk management requirements.

Frequently Asked Questions

1. What does commercial crime insurance typically cover?

Depending on the policy, it may cover specified financial losses arising from employee dishonesty, forgery, funds transfer fraud, computer-related fraud, and other defined criminal acts. Actual coverage depends on policy wording, exclusions, limits, and conditions.

2. How do insurers assess employee fraud exposure?

Insurers may examine employee access to funds, segregation of duties, payment approval procedures, internal audits, financial controls, and previous fraud incidents. They also consider the potential financial impact of dishonest activity.

3. Why are funds transfer controls important in underwriting?

Electronic transfers can result in significant losses when payment instructions are manipulated or unauthorized. Independent verification, dual approval, access restrictions, and transaction monitoring can help reduce exposure.

4. What information may an insurer request during underwriting?

An insurer may request business information, financial statements, transaction details, employee access procedures, internal control documentation, previous loss records, and details of existing insurance arrangements.

5. How should a business evaluate commercial crime policy coverage?

A business should review the covered loss definitions, limits, sublimits, deductibles, exclusions, discovery requirements, reporting conditions, and interaction with other insurance policies. The assessment should reflect the organization's actual financial exposures.

Conclusion

Commercial crime insurance underwriting evaluates the financial exposure arising from employee dishonesty, funds transfer fraud, forgery, and other specified criminal activities. The assessment depends on the organization's financial processes, internal controls, transaction patterns, loss history, and requested policy structure.

Businesses can prepare for underwriting by documenting financial responsibilities, strengthening payment verification, maintaining independent reconciliations, reviewing system access, and recording previous incidents and corrective actions.

A careful evaluation of policy limits, exclusions, reporting requirements, and coverage definitions can help organizations understand how commercial crime insurance fits within their wider financial risk management framework.