Outsourcing can create gaps in supplier coverage, contractual allocation of risk, and the buyer’s own insurance. This guide explains how to review those three areas.
We took a look at the Insurance Bureau of Canada’s business-coverage guide, the Office of the Privacy Commissioner of Canada’s third-party guidance, the Canadian Centre for Cyber Security’s recommended cloud-contract clauses, and the Canada Revenue Agency’s worker-status guide and have lots of suggestions for ensuring that your contracts and insurance match up. Read on for details.
Where Outsourcing Insurance Gaps Usually Appear
The supplier’s insurance may exclude the service it provides. The damage might exceed its insurance. Your contract with the supplier might make you responsible for their actions. Your insurer may require you to notify them when you make significant changes to your business, such as hiring a supplier.
Why Outsourcing Creates Coverage Gaps
Third-party risk is dependent on the services being outsourced and the exposures that could lead to losses. Outsourcing accounting, IT, logistics, manufacturing, customer service, or other specialized functions may create exposures related to those services.
For example, the exposures related to a delivery company likely differ significantly from those of a software supplier or a consultant. Accidents in transit and cargo damage would be common exposures for delivery. Data breaches, business interruptions, and intellectual property claims are more common exposures for a software supplier. Financial losses from professional errors would be common exposures for a consultant.
Start with a hypothetical loss event, identify who performs the function and who controls the related risks, and assess the contract, insurance, and claim-handling arrangements between the two.
Why One General Liability Policy May Not Be Enough
Many standard commercial general liability (CGL) policies assume you’re covering your direct employees, your listed operations and your in-house premises. This means that they may exclude liability tied to subcontractors, independent contractors, outsourced operations, cross-border exposures, or specific professional errors.
Note as well that your policy might only apply if you have control over the work environment, which you often don’t with fully outsourced work. In sum? Just because you’re insured doesn’t always mean all the risk from outsourced work is automatically covered.
How to Insure Outsourced and Contracted Work Properly
Ensuring outsourced and contracted work that is properly managed involves knowing what to ask for and building risk management into every outsourcing relationship. Here’s how you can close those gaps and keep coverage airtight:
- Check vendor’s insurance: Ask for certificates of insurance and verify policy limits and expiration dates.
- Adapt your policy: Talk with your insurer about extending your policy to cover outsourced work.
- Clarify worker classification: Worker classification rules vary by province. Make sure independent contractors are truly independent to avoid coverage and legal issues.
- Consider cyber and professional liability cover: If you outsource digital, creative, or advisory work, these policies are essential to protect against costly mistakes or cyber risks like data incidents.
Read More: Explore Commercial General Liability Insurance
What a Certificate of Insurance Does and Does Not Do
Request updated certificates when policies renew and when a project’s scope changes significantly.
A certificate of insurance is not an insurance policy and doesn’t provide blanket assurance that policies are in force or premiums are being paid. If additional-insured status is required, ask for the endorsement and make sure the contracted work is covered.
Read More: Read the Canadian Certificate of Insurance Guide
Contract Clauses to Review Before Work Starts
- Clearly define the scope of work, deliverables, locations, users, and types of data.
- Address indemnity and defence obligations and carve-outs from the liability cap.
- Address subcontracting, including approval rights and flow-down requirements.
- Specify applicable law, territory, service and data locations, and the jurisdiction for claims.
- Address incident requirements, including prompt notice, cooperation, preservation of evidence, notifications, and communications.
- Address insurance requirements, including the type, limits, and duration of coverage, evidence of insurance, notice of cancellation, and extended reporting periods where applicable.
- Address data security and privacy, including security requirements, access, audits, deletion, retention, return, and subcontractors.
The Privacy Commissioner has noted that an organization remains responsible for protecting personal information it transfers to third-party processors. In addition, the Cyber Centre’s cloud-computing security guidance recommends customizing contracts to the services and applicable privacy legislation and clarifying security, data protection, audits, incident response, data location, subcontractors, and contract termination.
Read More: Use the Insurance Guide for Canadian Businesses Expanding Into the U.S.
Worker Status Is a Separate Question
Calling a worker an independent contractor does not make them one for Canada Pension Plan or Employment Insurance purposes. The CRA looks at the facts that describe your relationship. In Quebec, a different approach applies.
Don’t assume that your vendor’s contract establishes worker status. Worker status has important implications for your organization, including payroll obligations, workers’ compensation, employer liability, and other insurance.
If an Outsourced Incident Happens
First, protect people and secure affected property and systems. Preserve evidence, including logs, contracts, correspondence, and photos of physical damage.
Notify your insurer or broker according to the required procedure, even if your supplier does not admit liability. Initiate the applicable contractual incident and cooperation clauses. Consider whether notice needs to be given to subcontractors. Coordinate privacy, regulatory, customer, and public statements with insurers and other qualified advisers as required.
Keep all records of decisions, recovery and mitigation steps, and insurance claims.
Read More: Read the Small-Business Data Breach Guide