'Transferred via insurance' at the outsourced distribution centre

'Transferred' is inaccurate. Insurance transfers a defined financial layer, subject to conditions. It transfers neither the operational consequence (five weeks of unfulfilled orders, customer loss, contractual liability, reputational damage) nor the exposures the policy excludes.

What the entry conceals:

• The retained amount is material, not low. The $4m deductible is retained risk and exceeds the owner's entire delegated authority.
• Uninsured exposure. Client-owned stock is excluded and unquantified - it could dwarf $12m, and Halcyon may owe the clients for it regardless of insurance.
• Coverage at risk. Eighteen months without sprinkler certification suggests a policy condition is unmet; a claim could be disputed. That is a risk to the treatment itself, and no one is monitoring it.
• Concentration is a separate, unregistered risk. One site carrying 60% of orders, with a competitor's recent five-week outage as directly relevant evidence, contradicts a 'low likelihood, low residual' conclusion.
• Owner authority. A risk owner requires accountability and authority; the procurement manager has neither for this exposure.

The treatment analysis required by Clause 6.5 was never done. Insurance is one sharing option among several: removing the risk source (fire suppression investment, certification as a condition), changing likelihood (audit and maintenance regime), changing consequences (dual-siting, splitting high-value or client stock, cross-docking arrangements), avoidance for specific lines, and informed retention with the level quantified. Options should be assessed on value versus cost, in combination, and against legal, contractual and social responsibility constraints - client stock is an obligation to clients, not merely a loss.

Acceptance must sit with the person whose delegated authority matches the exposure. With $4m retained, unquantified client stock and continuity exposure that could exceed $12m, that is executive level and probably the board or its audit and risk committee - not the procurement manager, who can own the treatment actions but not the acceptance.

How the decision should be made:

1. Quantify before escalating: client stock value on site, revenue at risk per week of outage, contractual and regulatory exposure, and the insurance gap including the deductible and exclusions.
2. Verify coverage in writing with the broker, and obtain the sprinkler certification or treat non-receipt as a live breach with a dated escalation.
3. Present options with cost-benefit, not a single recommendation: certification and suppression spend, dual-siting, contract renegotiation, revised insurance placement, and the alternative of accepting with eyes open.
4. Accept explicitly, with the rationale, the assumptions, the accepting authority, the date, and a review date or trigger.

Recording matters: Clause 6.7 exists so that a later reviewer can see who accepted what and on what basis. Silence is not acceptance, and an entry reading 'residual: low' written by someone without authority is worse than no entry - it creates the impression the exposure has been governed when it has not.

If nobody with authority will accept, that is itself a finding for the audit committee: the organisation has a risk it cannot decide about.

Treat the renewal date as leverage, not as a deadline that forces a decision.

Days 0-14 - establish facts. Obtain sprinkler and fire certification or issue formal notice of breach. Written broker confirmation of cover, deductible, exclusions and any conditions precedent. Count and value client stock on site. Model a five-week outage using actual order data to test the 'low' likelihood and impact ratings.

Days 15-45 - contract. Make certification currency a condition precedent to renewal. Add continuity obligations, service credits, recovery time objectives, audit and information rights, insurance requirements covering client stock (or explicit allocation of that liability), and notification duties. Do not sign before the numbers from days 0-14 are in hand.

Days 46-75 - treatment. Evaluate dual-siting or stock segregation for high-value and client lines, suppression investment, and a revised insurance placement at the next renewal, with costs against quantified benefit. Assign each action an owner and a date.

Days 76-90 - govern. Escalate the acceptance decision with the quantified residual to the executive and, if outside appetite, the board committee. Record per Clause 6.7.

Monitoring (Clause 6.6). Four indicators with thresholds and named owners: certification currency, closure of provider audit findings, percentage of orders through the single site, and insurance renewal confirmation. Add a review trigger for any provider incident, any change of provider ownership, and each policy renewal. Report monthly to the executive until the exposure is demonstrably reduced.