D&O Insurance for SMEs: Navigating the Liability Blind Spots Beyond Coverage
In Nigeria’s dynamic business landscape, Directors and Officers (D&O) liability insurance is increasingly recognised as a critical safeguard for Small and Medium-sized Enterprises (SMEs). However, a pervasive misunderstanding often clouds the true scope of this protection, leaving those most exposed unaware of the specific liabilities they face. While D&O insurance is designed to cover financial damages arising from claims against directors and officers, it does not, and cannot, eliminate the underlying causes of such claims.
What was once a niche product for publicly listed corporations has evolved into essential protection for SMEs across various sectors. This shift is driven by a confluence of factors: escalating insolvency rates, increasingly stringent regulatory environments, and a more proactive enforcement stance by regulatory bodies. Leaders in sectors such as construction, retail, hospitality, and business-to-business services are navigating a significantly heightened liability landscape compared to a decade ago. Globally, the financial sector continues to dominate the D&O market, accounting for approximately 30 percent of the total volume, driven by heightened regulation, substantial assets under management, and increased personal exposure for individuals. Yet, the most significant growth impulse for D&O insurance is emerging from the SME sector, where a fundamental lack of clarity persists regarding who is actually protected by these policies.
When legal action arises, the Chief Financial Officer (CFO) is almost invariably the most exposed individual. While a D&O policy ostensibly covers all current, former, and future board members, as well as senior employees, the reality of risk distribution is far more nuanced. The Chief Executive Officer (CEO) bears responsibility for strategic misjudgments and organisational deficiencies. The CFO, however, faces heightened scrutiny due to potential issues such as incorrect balance sheets, flawed liquidity planning, delayed insolvency filings, or management decisions predicated on inaccurate market analyses, particularly in the context of mergers and acquisitions. Chairmen of the Board and members of the Audit Committee are liable not for their actions, but for their failure to prevent certain outcomes. Furthermore, Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs) are increasingly facing personal liability under regulations like the NIS-2 Directive, revised data protection laws, and DORA, with the liability resting on the individual rather than the institution. The D&O policy encompasses this entire spectrum of potential claims, but it does not alter the existence of these distinct liability areas.
A significant oversight, even among well-informed board members, lies in the concept of the “de facto board member.” Modern D&O policies extend coverage beyond formally appointed board members to individuals who, without a formal mandate, exert substantial influence and direct business management. This includes consultants, interim managers, and project managers who possess de facto decision-making authority. Anyone acting in an interim executive capacity, such as CEO, CFO, or COO, and making actual management decisions, is legally liable as if they were a registered board member, irrespective of contractual stipulations. The legal underpinnings for this are robust, drawing from provisions such as Section 716a of the Swiss Code of Obligations (OR), which defines non-transferable duties of the Board of Directors, and Section 717, which establishes the duty of care. For regulated entities, additional layers of liability are introduced by FINMA regulations, the Anti-Money Laundering Act (GwG), and DORA, each creating its own distinct liability framework. The designation of a “de facto board member” is not a grey area; Swiss law imposes precise liability consequences.
Historical cases underscore these risks. For instance, in one of the most significant estate proceedings in Swiss economic history, 19 individuals, including former board members and senior executives, faced indictment. While ultimately acquitted, the legal costs and reputational damage were substantial. In another instance, the renovation of an ice rink project, which exceeded its budget by CHF 3 million, led to the replacement of the entire Board of Directors. Subsequent liability claims filed by the new board resulted in settlements of CHF 400,000 from the responsible architect and CHF 200,000 from the former board. Furthermore, six former members of executive management were held personally liable for CHF 350,000 due to the misuse of the group’s investment company for personal asset investments.
From a practical perspective, an interim mandate focused on optimising governance within an owner-managed SME involved a detailed audit of the existing Compliance Management System (CMS). This process revealed gaps in insurance coverage when compared against the newly identified risk profile. Consequently, the D&O policy was adjusted and expanded, with favourable terms secured due to the enhanced internal control system (IKS).
The increasing age of senior executives also presents a significant, often overlooked, liability issue. The average age of CEOs in large Swiss companies has risen to 56, with the proportion of decision-makers over 70 doubling in a decade to six percent. This demographic trend is not merely a governance side issue; it is a primary liability concern. Board members approaching retirement are not just protecting the company; they are safeguarding their life’s work, their retirement provisions, private assets, and decades of reputation. A lawsuit directly impacts the individual, not just the legal entity. A significant age disparity between the CEO and the Chairman of the Board is statistically recognised as a governance risk factor, which insurers factor into their pricing. Consequently, discussions around D&O insurance are, in essence, governance conversations.
The fundamental diagnosis for many organisations is “LIABILITY BLINDNESS,” a state where board members acknowledge their liability but lack clarity on its specific nature and origins. This condition cannot be remedied by an insurance policy alone. It is imperative to understand that while a policy compensates for damages, it does not eliminate the root causes. These causes typically stem from inadequate governance documentation, ambiguous oversight responsibilities between the board and executive management, and control systems (CMS, IKS) that exist on paper but are not effectively implemented. The solution lies in “Compliance by Design,” where governance requirements are integrated into processes, decision structures, and internal controls from inception. Organisations adopting this proactive approach not only face lower premiums but also present a less attractive target for litigation.
Those who focus solely on the insurance contract are addressing symptoms, while those who examine the underlying governance structures are addressing the cause. As a Governance, Risk, and Compliance (GRC) sparring partner, a recurring observation in discussions with management bodies is the presence of a D&O policy coupled with a lack of awareness regarding concrete personal liability positions. The terms “covered” and “protected” are often conflated, yet they represent distinct concepts. “Covered” implies that damages will be compensated when they occur, whereas “protected” signifies that governance is structured to minimise the likelihood of such occurrences.
D&O liability transcends departmental silos. The CEO can be held liable for failures in communication from the legal department or security breaches originating from IT. A departmental approach to risk assessment is inherently incomplete. The critical question for any board is the extent of the gap between what they formally sign off on and what they can realistically be held accountable for. This assessment determines whether the D&O policy serves as a genuine protective instrument or merely a pacifier.
Before embarking on new mandates, a GRC DIAGNOSIS, typically requiring four hours, can provide a prioritised gap list and a concrete 60-day implementation plan. The minutes of the next Board of Directors’ meeting should prompt a crucial question: does every individual at the table fully comprehend what they are personally endorsing? Turning regulatory compliance into tangible business value is the ultimate objective.
