For many organisations, a Business Continuity Plan (BCP) only comes onto the radar when an insurer or broker asks for one.
Sometimes it’s presented as a requirement – you must have a BCP to obtain cover.
Sometimes it’s a recommendation – not compulsory, but strongly advised and likely to influence terms.
Either way, the request usually triggers the same response: “We’ve got something already – will that do?”
In our experience, that “something” rarely provides the assurance the insurer is actually looking for.
Why insurers ask for a BCP in the first place
When an insurer places cover, they are fundamentally trying to understand risk.
One of the largest and least predictable risks they carry is business interruption: the financial loss that occurs when a physical incident prevents the business from operating.
For office‑based organisations, that risk can often be mitigated relatively quickly.
For businesses reliant on bricks and mortar – manufacturing, wholesale, logistics, food production – it is very different.
A fire‑damaged plant, flooded warehouse, or failed utilities system can instantly stop trading.
From an insurer’s perspective, these are large, concentrated single points of failure.
A BCP is therefore not a governance exercise. It is the insurer’s way of asking a very direct question:
If we insure this business, how confident are we that it can recover operations in a reasonable timeframe?
To be clear, insurers and brokers remain responsible for advising on policy structure, sums insured and cover terms.
Our role sits on the other side of that conversation: helping organisations articulate how they would recover from disruption, so insurance decisions are based on a realistic understanding of operational risk.
Why most existing plans don’t provide that assurance
Most organisations we work with already have a continuity plan of some description.
The problem is not intent – it’s relevance.
The most common issues we see are that plans are:
- template‑driven or boilerplate
- several years out of date
- written to be “generically complete” rather than risk‑specific
- focused on process checklists rather than recovery reality
They often describe what continuity planning should look like, but never truly answer the insurer’s core concern: what happens to the business if the site is lost?
Ironically, from an insurance point of view, many plans say too much about things that don’t materially affect the insurer’s exposure – and too little about the things that do.
A note on AI‑generated Business Continuity Plans
In recent months, we’ve also seen a growing number of continuity plans produced using AI writing tools.
Used carefully, AI can be helpful for structuring documents or improving clarity. However, problems arise when AI is used as the starting point rather than a support tool.
From an insurance perspective, AI‑generated BCPs often amplify the same issues found in templates:
- generic language that could apply to any organisation
- inconsistent or untested assumptions about recovery times
- limited understanding of site‑specific constraints
- no credible link between physical loss and operational recovery
The result is a plan that reads well, but does not provide meaningful assurance that the business could actually recover following a physical interruption.
Where AI does add value is later in the process – helping refine language, maintain plans, or document outcomes once recovery strategies have been properly defined by the business.
That distinction matters, particularly when a BCP is being reviewed through an insurance lens.
The insurer’s lens: fewer risks, but examined properly
When business interruption is the driver, insurers are not asking you to plan for every conceivable disruption.
They care about the scenarios that expose them financially.
Typically, those are scenarios where a physical incident removes your ability to operate from a site.
That does not mean people, supply chain, or technology are irrelevant – but they matter only in so far as they are impacted by that physical loss.
A strong, insurance‑led BCP therefore focuses on:
- what is actually produced or delivered
- where it is produced or delivered
- what physical assets and utilities are required
- how capacity can be restored if those assets are lost
Anything that does not meaningfully change interruption loss is secondary in this context.
Business interruption and BCP: inseparable, but usually treated separately
In most insurance placements we see, BI and BCP are handled sequentially.
First comes the BI discussion: turnover, gross profit, uninsured working expenses, indemnity periods.
Only later – often if the insurer insists – does BCP appear as a separate exercise.
Many brokers will offer a BI review service that focuses on calculating potential losses and discussing appropriate cover durations. These are useful, but incomplete.
They rarely answer the most important question:
Is this indemnity period backed by a credible recovery capability?
BI policies often assume a like‑for‑like rebuild as the default recovery strategy. In reality, very few businesses can afford either the time or the commercial impact of waiting for a full rebuild before trading resumes.
This gap – between how BI is structured and how recovery would actually work – is where most insurer discomfort and underinsurance issues arise.
Why this matters even more for single‑site operations
Single‑site organisations face the hardest version of this problem.
If you lose the site, you lose the business.
There is no geographic redundancy to mask weak assumptions.
A common mistake is treating site loss as a binary event: all gone, then all back.
In reality, recovery is often phased. It involves partial loss, internal reconfiguration, temporary outsourcing, and extended periods of reduced capacity before normal operations resume.
A credible continuity plan reflects that reality – and turns it into something insurers can understand and work with.
What insurers actually find reassuring
Based on the plans we review for insurance‑driven clients, insurers respond best when they can clearly see:
- Defined impact tolerances
How long can critical activities be down before the impact becomes unacceptable? - Mapped critical processes and assets
What equipment, utilities, people and space are genuinely required to operate? - Scenario‑specific recovery strategies
Particularly for partial and total loss of site – not generic incident response. - Recovery curves, not just end states
How much capacity returns after one week, one month, three months? - Evidence of realism
Clear ownership, acknowledged constraints, and assumptions that reflect physical reality.
None of this requires a long or complex document.
It requires focus.
Why we deliberately connect BI and BCP in our work
Our experience is that BI and BCP are most effective when they inform one another.
By starting with an insurance‑led view of interruption – understanding worst‑case disruption, recovery capability and confidence in strategy – the continuity plan becomes sharper, more relevant and easier to assess.
Rather than asking “do we have a BCP?”, the conversation becomes:
Does our recovery strategy support the indemnity period we’re discussing with our broker? If not, which assumption is wrong?
That alignment reduces friction at renewal, improves insurer confidence, and results in continuity plans that are actually used rather than filed away.
A practical closing thought
If an insurer or broker has asked you for a BCP, the fastest route to a positive outcome is not perfection – it is relevance.
A plan that directly addresses business interruption risk, acknowledges physical constraints, and demonstrates credible recovery thinking will go much further than a generic, best‑practice document.
In insurance terms, it shows that the business understands its own exposure – and is actively managing it.
Frequently asked questions about BCPs, insurance and AI
Do insurers require a Business Continuity Plan?
Sometimes.
In certain cases, insurers will require a Business Continuity Plan as a condition of cover. In others, it is a recommendation rather than a strict requirement, but one that may influence underwriting decisions, premiums or exclusions. Whether it is mandatory typically depends on the nature of the business, the assets being insured, and the perceived business interruption risk.
Why does my insurer want a Business Continuity Plan?
Insurers use a BCP to understand how a business would recover after a disruptive incident, particularly where a physical loss could prevent operations. From an insurer’s perspective, the key question is not whether a plan exists, but whether the business can realistically resume trading within an acceptable timeframe after a disruption.
Is a template Business Continuity Plan enough for insurance purposes?
Often, no.
Template or boilerplate plans commonly fail to address the specific risks that insurers care about, particularly loss of site, recovery times and constrained capacity. Insurers generally gain more confidence from a plan that is clearly tailored to the organisation, reflects real operational constraints, and focuses on credible recovery strategies rather than generic checklists.
What does a “good” BCP look like to an insurer?
A BCP that insurers find reassuring typically shows:
- defined impact tolerances for critical activities
- clear identification of critical processes and physical dependencies
- scenario‑specific recovery strategies, especially for site loss
- an understanding of how capacity returns over time, not just an end state
The emphasis is on credibility and realism, not length or technical jargon.
Is business continuity planning the same as Business Interruption (BI) insurance?
No, but they are closely connected.
Business Interruption insurance provides financial protection when operations are disrupted. Business continuity planning focuses on how operations would actually be recovered. Insurers typically view BCPs as a way of assessing whether the assumptions behind BI cover — such as the indemnity period — are realistic.
Do I need to design my BCP around my insurance policy?
No.
Insurance policy structure and cover decisions should always be handled by insurers and brokers. A BCP should instead focus on articulating how the business would recover from disruption. When done properly, this allows insurance decisions to be made on a clearer, more realistic understanding of risk.
Why are BCPs especially important for single‑site businesses?
Single‑site organisations often have large single points of failure. If the site is lost, operations may stop entirely. For these organisations, insurers are particularly interested in whether recovery can occur through partial site use, reconfiguration, outsourcing, or phased restoration — rather than assuming a full rebuild before trading resumes.
Does having a BCP guarantee better insurance terms?
No guarantees — but it can remove uncertainty.
A credible, relevant BCP helps insurers better understand operational recovery risk. This can reduce friction at renewal and support more informed underwriting discussions, but cover terms and pricing decisions always remain the responsibility of insurers and brokers.
Can I use AI to write a Business Continuity Plan for insurance purposes?
AI can help with formatting, wording and document clarity, but it should not be relied on to define recovery strategies or risk assumptions.
From an insurance perspective, a BCP must reflect how a specific business would recover from disruption, particularly following physical loss of a site. AI‑generated plans often struggle to account for real‑world constraints such as equipment lead times, utility dependencies and phased recovery of capacity.
AI is best used as a support tool, not a substitute for operational recovery thinking.
Why do insurers often distrust AI‑generated BCPs?
Insurers are not concerned with how a plan is written, but with whether it demonstrates credible recovery capability.
Plans generated primarily by AI tend to:
- rely on generic scenarios
- assume ideal recovery conditions
- understate physical rebuild and commissioning timelines
- lack clear ownership and tested assumptions
As a result, they often fail to reduce uncertainty around business interruption exposure – which is the insurer’s main concern.