One guide · one workbook · CAD $95
The form asks forty questions you cannot all answer with certainty
So most organisations answer optimistically, because the alternative appears to be no cover. Then, at the worst possible moment, an adjuster asks what those answers were based on.
What actually goes wrong
The mechanism is not obscure. A material misrepresentation on an insurance application — including an inaccurate answer given entirely honestly — can give an insurer grounds to deny a claim or rescind the policy. You do not have to have lied. You have to have been wrong about something that mattered.
The questions that catch people are rarely the hard ones. They are the ones that sound simple. Is multi-factor authentication enforced on all email accounts? Yes, you think — and then nobody remembers the three shared mailboxes, or that legacy sign-in was never switched off. Do you test your backups? The backup job runs nightly, so yes — except a backup completing is not a restore succeeding, and nobody has ever tried.
- The right answer is the accurate one, not the favourable one. A “partial” that is priced correctly is worth immeasurably more than a “yes” that fails when you claim. Nobody has ever been denied a payout for being too precise on a form.
- Answer as at today, not as at the day you intend to be ready. A control being purchased, scheduled or half-deployed is not a control you have. Underwriters read the note explaining that; adjusters read the answer.
- Keep the basis, not just the answer. What protects you a year later is a dated record of what you relied on and who confirmed it. That record is most of what this product is.
What you get
The application companion
A nine-page guide and a workbook. Written to be used while you complete the form, not read afterwards.
- The guide. Fifteen areas, each with what the question is actually asking, the trap in it, what a defensible answer needs behind it, and what to do when the honest answer is no or partial.
- The workbook. Your answer, the evidence you relied on, where that evidence lives, who confirmed it and on what date — one row per question.
- A summary that counts the two things that matter: answers with no evidence recorded, and answers with no confirmation date. Those are the ones you could not defend later.
- An index of fifteen artefacts that, between them, answer the form and prove how you answered it.
CAD $95
Buy the companion — $95Secure checkout by Stripe · PDF and Excel · emailed within one working day
Answer question 11 for free first
One of the fifteen asks when you last tested your incident response plan. For most small organisations the honest answer is never, and that is fixable in ninety minutes.
- The ransomware tabletop exercise is published complete on this site and costs nothing.
- It produces a one-page evidence record — date, participants, findings, actions — which is exactly what that question is asking for.
- No email address, no form, no follow-up.
Free
The free tabletop exercisePublished in full · nothing held back
The fifteen areas
Multi-factor authentication on email, on remote access, on administrator accounts and on cloud services — four separate questions, because insurers treat them separately and organisations rarely do. Endpoint detection and the percentage actually covered. Backups: offline or immutable, and when a restore was last genuinely tested. Patching cadence and end-of-life software. Email filtering, and whether your DMARC record enforces anything or merely watches. Separation of administrator accounts, and how many there really are once suppliers are counted. Awareness training and phishing simulation, measured by completion rather than enrolment. Your incident response plan and when it was last exercised. Verification of changes to bank details, which is the loss small organisations actually suffer. Prior incidents and known circumstances — the question with the most severe consequence on the form. What data you hold and roughly how much. And who provides your IT, and what standing access they have into your systems.
English. Available in French Canadian on enquiry — tell us and we will say honestly how long it would take.
Where the line falls
We are not brokers, underwriters or agents. We take no commission from any insurer and we do not sell insurance.
That is precisely why this is worth reading. A broker is paid when the form is completed. Your IT provider, asked to confirm the technical answers, is being invited to grade its own work. Neither is dishonest — but neither is disinterested, and you are the one whose claim depends on the answers being right. This is not legal or insurance advice, and insurance law varies by province. Where an answer is close, ask your broker to put their view in writing, which is useful to have regardless.
A workbook is not a management system, so buying this does not stop us carrying out an independent assessment of your organisation later. We say which side of that line a purchase falls on before you buy, not after.
Before your next renewal
Answers decay. Staff leave, systems are added, and a control that was true at last renewal may not be true now. Most policies also require you to tell the insurer when a material answer changes mid-term rather than at renewal — which is far cheaper than explaining it afterwards. Re-run the workbook each year and keep it with the policy.