E&O Report | E&O prevention: The view from 30,000 Feet
E&O Report | August 2026 | Volume 41, Number 8
For many years now, whether it is through my participation in the BIG I E&O CE seminars or the many years of authoring the monthly E&O Prevention articles, I have focused on the nuts & bolts, the minutia if you will, of how to avoid E&O claims by putting into practice certain procedures and rules for your agency. Some of the many examples include the “Cannot Bind or Change” coverage ending to your emails and VM messages, making sure to have signed applications, signed coverage rejections and documentary proof of policy transmittal to the Insured-Client. Even documenting any and all communications with the Insured.
Recent events in which I was involved reminded me and thus my desire to remind and highlight this to you members that E&O Prevention is a lifestyle and it starts at the top. It is an “Ethos”… the core beliefs, habits, and spirit that shape an organization, or society. So today I will write from the macro-perspective. The View-from-the-Top as they say.
E&O EXPOSURE
WHERE DOES IT COME FROM
But before that, I want to go even higher up so that you understand in the broadest sense, where your potential E&O claims emanate.
Yes, the bulk will come from your Insureds-Clients who, legitimately or not, feel that they did not get the right coverage or the account was not serviced correctly. That is the bulk, the majority of the claims that you are exposed to. But…. there is a more concerning, albeit less frequent source of such claims. That is DFS investigations.
Understand this. When you are sued by a client, all that can happen is that you/your E&O carrier has to pay money damages. I do not mean to minimize such damages. I mean that a Civil Lawsuit by your Client will not result in suspension or termination of your license and inability to make a living. The DFS can do that to you.
Know that while a Civil Lawsuit is limited to a practical, narrow and focused factual and legal dispute, investigations by the DFS are not. While they may start out with something narrow and factually limited, once they start investigating that triggering thing, all bets are off and they can investigate whatever else they want. More to the point, anything they see that is a violation of regulations while investigating the triggering event, is fair game for them. While their penalties can be assessed on a per violation basis and can quickly escalate with factor multipliers that add up, such fines and penalties are often much less than even a small E&O claim by your Insured. But, depending on the nature of the violation, the DFS can affect you license. Hence the need to understand that good E&O Procedures are to avoid not only Client claims but DFS investigations.
As a current example, the DFS Cybersecurity regulations are massive, complicated and byzantine. Backing into what I know to be areas where they have fined broker and carriers, they are strict about complying with such regulations as to:
- Failing to implement multi-factor authentication (MFA) on email systems for individuals accessing the internal networks from an external network;
- Lacking a data retention policy, allowing excessive storage of sensitive emails, and failing to develop policies and procedures for the secure disposal of NPI.
- Delaying notification to NYDFS thereby violating the 72-hour reporting requirement from a determination that a reportable cybersecurity event has occurred.
- Filing improper annual certifications attesting to its compliance with the cybersecurity regulation.
- Lack of Documentation for Cybersecurity Policy–Documentation to implement and maintain a written policy to address business continuity and disaster recovery planning and resources (BCDR).
- Lack of Limitations for Access Privileges–The requirement to limit access privileges, including storing key passwords in a shared folder named “PASSWORDS.”
- Cybersecurity Personnel and Intelligence Training Deficiencies.
- Issues with Third-Party Service Provider Security Policies.
If they investigate one of these things, they will start looking at the others.
So whether it is E&O Prevention as to the DFS or Clients, what is the BIG PICTURE. Simply, it is the “Mindset” of your agency as to E&O Prevention.
E&O PREVENTION MINDSET
THE ETHOS OF AN AGENCY
There is an old aphorism that goes “A fish rots from the head down…”. There is also a corollary, (and less off-putting), that says “As the leader goes, so goes the team.” Etymologists trace those statements back to the Bible (Matthew 7:17) and the saying that “A good tree bears good fruit.”
I was recently reminded of this when I did an In-Person Audit of an Agency-Member’s operations. This was a multi-generational agency with roots in the community and a stellar reputation. To my knowledge going back to our Lustig & Brown, LLP days, we were never asked to defend them in an E&O litigation. And there was a reason for that.
From the founders of the company down the generations, the Owners and Principals have cared as much about E&O Prevention as Client service. And the two go hand in hand. I spent many hours interviewing Senior Management and the Lines Department Heads. Everyone one of them had E&O prevention forefront in their minds alongside of client service. That example, as I saw, was followed by Producers, Account Managers, CSR, Administrative Staff etc etc. They were the poster-child for everything we have been suggesting for decades and it showed. The metrics were no E&O claims and a very high client retention.
Making E&O Prevention part of the DNA of your Agency actually streamlines your operations. When it becomes second nature and just part of your everyday procedures, it does not take additional time or effort. Getting the signed application, saving the email that transmitted the quote to the insured and its response. Proving policy transmittal to the insured etc etc. Your AMS systems are designed to make these memorializations easy for you and that is aside from the greater tool ever created for E&O Prevention—EMAIL.
CONCLUSION
I am not so naïve to believe that any Agency can be bulletproof from E&O claims, legitimate or not. While I could create policies and procedures for you that would come close, compliance would grind your business to a halt and not be worth it. At the end of the day you have a business to run. Risk is inherent in any business and yours is literally and historically, (going back to the first written framework for risk transfer with the Code of Hammurabi of around 1750 BC), is all about “Risk”. But you can minimize it for your agency but adding that as part of your Mission Statement, Corporate Ethos and Mindset. I, and the BIG I, can help, as we’re here for you.
Submitted by:
Howard S. Kronberg, Esq.
Kaufman Dolowich, LLP
Topics
