True or False? Companies that identify and develop disaster avoidance, mitigation, response and recovery plans are likely to suffer fewer strategic, financial and operational losses and less adverse reputational impact than companies that have no such plans.

Although common sense would suggest that the statement is true, and examples exist to confirm it, many companies do not have comprehensive and tested emergency response, business continuity or information security plans. And curiously, many underwriters of property and other risks do not require insureds to have them.

Why is that? For insureds, probably the most significant reason is that developing and maintaining business continuity plans requires commitment, time and effort. For underwriters, the same applies to relating the use of such plans to the underlying risk equation. There are other reasons as well, such as lack of expertise and resources, other priorities, and even skepticism.