Growth is the good problem. But policies are sized to a snapshot of the firm, and every good year moves the firm further from the snapshot. Here are the five signals that the numbers on paper no longer match the practice.
The answer
A firm has outgrown its insurance when the exposures have moved and the limits have not. Headcount, settlement size, client requirements, and partnership structure are the four dials that move. If any of the five signs below sounds familiar, the program is describing a firm that no longer exists.
Employment practices limits are priced and sized around the firm on the day the policy was written. Federal discrimination charges climbed to 88,531 in fiscal year 2024, rising for the third straight year, and every attorney and staff member added since your policy was placed raises the number of potential claimants against a limit that stood still.
The renewal invoice will not flag this. The premium can look perfectly reasonable while the limit quietly falls behind the firm.
Tie the EPLI limit to current headcount once a year. The full pattern lives at law firm EPLI.
Partnership admissions, departures, and compensation restructures are the seasons when employment and management disputes actually surface. They also change who counts as an insured under your policy definitions, because partners, of counsel, and contract attorneys can each land differently under the form.
A program written for the old partnership can misdescribe the new one in ways that only show up at claim time.
Have the insured and employee definitions re read after every transition. It is a document question with a document answer, and it takes one meeting.
When corporate clients ask for security assessments and proof of cyber coverage before sending work, the market is telling you the firm has crossed a threshold. Coverage has become a business development document, not just a protection.
Firms that answer those questionnaires with a thin endorsement on the malpractice policy often lose the comparison to firms carrying a real standalone program.
Match the policy to what your best clients now expect. The boundary between malpractice and cyber is mapped at law firm cyber insurance.
Social engineering fraud coverage carries its own sublimit, and it was sized to the wires the firm sent when the policy was placed. A firm now moving six figure settlements through its trust account can be carrying a sublimit written for a much smaller practice.
The FBI logged nearly $2.8 billion in business email compromise losses in 2024, and law firm settlement wires are a documented target because the underlying cases are public record.
Size the sublimit to the largest realistic single wire, and pair it with a callback verification procedure. The full anatomy lives at social engineering fraud for law firms.
This is the quietest sign and the most telling. If the honest answer to which contract pays for the forensics, which one notifies the clients, and where the malpractice policy stops is nobody knows, then the program is a stack of policies rather than a plan.
Coordination is the broker's job. If it is not happening, that is the gap, independent of any limit on any page.
Put one annual review on the calendar where every policy is read together. The coordinated program is mapped at Houston law firm insurance.
Growth is the good problem. The policy just never hears about it unless somebody asks.
Dallas Downey, CLCS, Commercial Lines and Workers Compensation Specialist
This article uses public source material from the Equal Employment Opportunity Commission and the FBI Internet Crime Complaint Center.
The purpose is to help you ask better questions at renewal. The statistics describe the direction of the threat. Whether your firm has outgrown its program is answered by your headcount, your wires, and your documents, which is exactly what the review reads.
Run the three number test. Compare current headcount to the headcount when the EPLI policy was written, compare your largest routine wire to the social engineering sublimit, and compare your client contract requirements to the coverage you can actually evidence. If any pair does not match, the program is describing an older firm.
A due diligence form corporate clients send before engaging a firm, asking about data security practices, incident history, and insurance. Answering well increasingly requires a standalone cyber policy with real limits, which is why coverage has quietly become part of winning work, not just protecting it.
Yes, directly. The social engineering fraud sublimit should reflect the largest realistic single wire, and business interruption limits should reflect what a week of lost billable capacity now costs. Both numbers were set when the firm was smaller, and neither updates itself.
One meeting, your current policies, and your real numbers. We tie each limit to the firm you run today, read the seams between the contracts, and tell you plainly if the program holds up. About 40 percent of the time we tell clients to stay with their current carrier because that is the right answer.
Send us the policies you carry today with your current headcount and your largest routine wire. We will show you exactly where the program still describes a smaller firm, in plain English, before a claim runs the comparison for you.
Commercial reviews route to our commercial desk and follow your calendar, not ours. Local broker. National infrastructure.