Question 1

Is Breezy Risk an insurance broker?

Accepted Answer

No. Breezy Risk is a fee-only consulting firm. I do not sell insurance, place policies, or earn commissions. I review and audit your existing insurance program and report what I find. If you want to act on the findings, you take them to your broker, or I can help you find one. The audit is the product, not a step toward a sale.

Question 2

How does an insurance audit differ from what my broker already does?

Accepted Answer

Your broker places insurance and earns a commission on what they sell. That is a useful service, but it is not an independent assessment.

I serve a similar function to an external auditor: independent, fee-based, no broker of record letter. I read the full policy wording, test it against specific incident scenarios, and report what I find. Most broker reviews focus on limits and premiums. I focus on the policy language that determines whether a claim gets paid.

Question 3

Why community banks?

Accepted Answer

Because of how their insurance programs are structured. Banks carry three overlapping policies, cyber, D&O, and a fidelity bond, that interact in ways most brokers never examine together. I am specialized in analyzing how those three policies respond to common incidents, including wire transfer fraud, ransomware, regulatory investigations, and board liability.

More on community bank insurance →

Question 4

Does my cyber policy cover wire fraud?

Accepted Answer

For a community bank, usually not. Cyber carriers generally do not write eCrime or social engineering coverage to financial institutions. The line item can appear on the form, but the coverage is not offered in FI underwriting. That is a market appetite issue, not something your broker failed to buy.

That leaves the fidelity bond as the only policy that pays a wire fraud loss. Every bond I have read carries a social engineering endorsement, so the question is never whether you have the coverage. It is the sublimit, often $250K against a computer fraud limit many times larger, and the verification condition attached to it. Miss the required callback and the claim is denied outright rather than reduced. The bond's "voluntary parting" exclusion can also apply when an employee initiated the transfer. More on the three-policy interaction problem →

Question 5

Will my D&O policy protect the board after a cyber breach?

Accepted Answer

Probably less than you think. Most D&O policies for community banks include a cyber exclusion that excludes anything arising out of a cyber event. The intent is to push those claims to the cyber policy, and the cyber policy does catch more of them than most boards realize, because on every community bank form I have read in full, directors are named in its definition of Insured.

What it does not do is behave like a D&O policy. There is no Side A tower reserved for individuals, so the directors share one limit with forensics, notification and business interruption, and those costs land first. On some forms nothing counts as a claim until a formal proceeding begins, which leaves the pre-formal examiner activity uncovered. And a broad securities exclusion can still bar a post-breach derivative suit. I read both policies together and identify which of those three narrows applies to you.

Question 6

What is the Risk Intelligence Report?

Accepted Answer

A line-by-line analysis of your insurance policies against realistic claim scenarios. The report identifies where coverage responds, where it gets disputed, and where it fails. For banks, the centerpiece is the policy interaction analysis: how your cyber and D&O policies, and your fidelity bond, respond to the same incident, and where each carrier points to the other two.

The report includes specific findings, policy-language citations, and dollar-range exposure estimates. It is designed for three audiences: the board, the examiner, and the broker.

Question 7

What will my examiner ask about our insurance?

Accepted Answer

FDIC and NCUA examiners ask whether the board has reviewed the institution's insurance program in light of actual cyber and operational risk. They look for evidence of an independent assessment, not a renewal summary from a broker.

A Risk Intelligence Report is built for that question. It includes specific findings, policy-language citations, dollar-range exposure, and a remediation plan. You can put it in front of an examiner as documented evidence that the board has reviewed coverage against the scenarios most likely to trigger a claim.

Question 8

How long does it take to get a Risk Intelligence Report?

Accepted Answer

Typically one week once I have your documents. You send your current policies. I review coverage against realistic claim scenarios, then deliver the report with a walkthrough call.

Question 9

Do I need to switch brokers?

Accepted Answer

No. Most clients take the report to their current broker to renegotiate coverage at renewal, share it with their board or examiner, or use it as a baseline for year-over-year improvement.

No broker of record letter, no commitment to move your insurance. The audit is the product. What you do next is up to you.

Question 10

How much does an engagement cost?

Accepted Answer

Engagements are fixed-fee and project-based. A Risk Intelligence Report for a community bank typically costs less than a single penetration test or SOC 2 audit. No hourly billing, no retainer, no commitment beyond the engagement.

Contact me directly for a quote.

Question 11

How do CPA firms and compliance consultants work with Breezy Risk?

Accepted Answer

I work alongside CPA firms, IT auditors, and compliance consultants who already serve community banks. You refer a client who needs an independent insurance review. I deliver the report directly to the bank. The bank pays Breezy Risk directly, so there is no conflict with your audit independence.

Get in touch to discuss a partnership.

Question 12

What is a cyber insurance audit?

Accepted Answer

A cyber insurance audit is a review of your actual policy language to determine whether your coverage will respond when you file a claim. It is not a cybersecurity compliance check or a questionnaire from your carrier.

It examines your cyber and D&O policies, and your fidelity bond, together to find exclusions, sublimits, and gaps that would reduce or deny a payout after a ransomware attack, wire fraud, vendor outage, or data breach. For community banks, the audit also tests how the three policies interact, because that is where the most expensive coverage failures occur.

More on what a cyber insurance audit covers →

Question 13

What is an insurance gap analysis for a community bank?

Accepted Answer

An insurance gap analysis identifies the specific exclusions, sublimits, and policy interactions that would reduce or deny a claim. For community banks, this means reviewing three policies together: cyber, directors and officers (D&O), and the fidelity bond. Common gaps include D&O cyber exclusions that push the board's post-breach defense onto the cyber policy, wire fraud sublimits as low as $100,000, vendor outage coverage that does not match actual vendor dependence, and security warranty language that lets a carrier deny a claim based on a controls questionnaire. Breezy Risk's Bank Coverage Gap Framework tracks 24 scored gap patterns plus 16 further observations, across four categories: bank-specific cyber, fidelity bond, D&O, and the interactions between them.

Frequently Asked Questions

For Community Banks