Many nonprofits assume their insurance coverage is enough, but critical gaps can leave them exposed. This article explains where those gaps often exist and how the right coverage and risk management strategies can help build a more resilient organization.
Nonprofit organizations serve as key pillars of the community. Whether you are providing healthcare services, counselling, addressing food insecurity or housing support, your organization has unique and complex risk exposures that your insurance coverage needs to address.
Many organizations assume that standard insurance policies will fully cover their operations, but this can leave critical gaps in the event of a claim. Acera Insurance’s Mark Falcioni shares his insights into why a proactive, tailored insurance policy is essential for protecting staff, volunteers and clients, safeguarding your organization’s reputation and ensuring continuity of services.
The most common coverage gaps (and why they matter)
The hard reality is that many nonprofits are underinsured in critical areas. A common misconception is that a general liability policy will cover all operations, but that is simply not the case.
Common gaps include:
- Professional liability
- Cyber liability
- Abuse coverage
- Business interruption and property limits
Assuming that you are covered is one of the biggest risks you can take, which is why it’s important to conduct a thorough risk assessment when reviewing your insurance coverage each year. This will help ensure that your coverage aligns with your operations.
Understanding the difference: General vs. professional liability
As a nonprofit organization, your work provides critical services and supports to people from diverse backgrounds, helping people from all walks of life, who may be dealing with complex issues or situations. Unfortunately, this can put you at an increased risk of being sued.
When first looking at your insurance coverage, many people assume that general liability and professional liability are the same thing, which is not the case.
“General liability aims to cover your operational liabilities, whereas your professional liability is designed to cover negligence in the delivery of the services.”
– Mark Falcioni
What commercial general liability covers
Commercial general liability helps to cover costs associated with property damage, third-party injuries and potential legal expenses resulting from unexpected or negligent acts by employees and volunteers.
For example, if a client slips and falls during an in-person session at your office, or if you accidentally damage a community centre’s property while running a program, you could face expensive liability claims.
Commercial general liability does not cover:
- Expenses from claims related to intentional or criminal acts.
- Claims stemming from professional services such as counselling or medical support (this requires professional liability insurance).
What is professional liability insurance?
Professional liability insurance (also known as errors and omissions or E&O) will help you cover your defence costs if a client sues your organization for claims of negligence that caused financial damage. This can include legal expenses, court settlements and administrative costs.
For example: Your nonprofit provides counselling services to vulnerable individuals. A client later alleges that the counselling they received was inadequate, and that the organization failed to make an appropriate referral for further support. The client files a lawsuit for damages arising from negligent counselling. This is where your professional liability insurance would respond to the claim.
It’s important to note that professional liability insurance does not cover any intentionally wrongful, fraudulent or illegal acts, as well as claims for bodily injury or property damage, violation of workers’ rights or employment issues.
Abuse coverage: What triggers a claim
Since many nonprofits serve vulnerable populations by providing services like counselling, housing support and childcare, abuse and molestation coverage provides essential financial protection for your organization. Abuse coverage is designed to assist with defence and investigation costs, as well as reputational damage.
Abuse insurance claims can be triggered by allegations — not just proven acts. There are also two types of abuse wordings that organizations should understand:
- Occurrence-based wording: Covers claims tied to incidents that happened during the policy period, no matter when the claim is filed. Even if a claim is made years later, the policy can still respond if the incident occurred while the coverage was in effect.
- Claims-made wording: Covers claims reported only during the policy period, if the claim is made and reported in accordance with the policy terms. If a claim is made after the policy period, you will not be insured.
“Strong policies and procedures, training and documentation are just as important as having coverage.”
– Mark Falcioni
Risk management steps to help prevent abuse claims
The best thing you can do to protect your organization, staff and volunteers against abuse claims is to have strong risk management practices in place. This demonstrates to insurers that you understand the risks and have taken steps to mitigate them. Some examples include:
- Annual abuse prevention training for staff and volunteers.
- Require police and vulnerable sector checks every three years for all staff and volunteers.
- Document abuse prevention protocols.
- Enforce a two-adult and/or open-door policy for programs involving vulnerable people.
- Require reporting and follow-up for suspected inappropriate behaviour or incidents.
The biggest pitfall for a nonprofit with respect to abuse coverage is not monitoring and updating your organization’s abuse protocols regularly. These need to be consistently supported and documented so that you have proof in the event an abuse claim is triggered.
Managing risk with vehicles
If staff and volunteers use their personal vehicles to conduct work on behalf of the organization, such as delivering food or attending off-site meetings, this can leave your nonprofit exposed in the event of an accident claim.
Non-owned auto insurance protects your organization when staff use personal, rented or contractor vehicles for work. Unlike standard policies for owned vehicles, it covers a narrower group of insureds, typically including:
- Council, commission and committee members
- Trustees, board members, directors and officers
- Partners, employees and volunteers
For example, if an employee drives their personal vehicle to a work meeting and is involved in an at-fault accident, your organization could be named in an injury claim. In that case, non-owned auto insurance may respond to cover the organization’s liability.
Auto risk management steps you can take to protect your nonprofit
To help mitigate liability for non-owned auto risks, nonprofits should have protocols in place that include:
- Annual driver’s abstracts for employees and volunteers
- Licence verification
- Minimum insurance limits and proof of insurance annually
- Driver codes of conduct (such as seatbelt use and distracted driving)
- Post-accident procedures
- Protocols for rental vehicles
The upcoming Ontario auto reforms make this issue more important. As of July 1, 2026, Ontario’s Statutory Accident Benefits Schedule (SABS) changes significantly: Only medical, rehabilitation and attendant care remain mandatory, while benefits such as income replacement, caregiver, non-earner, housekeeping/home maintenance, death, funeral and other benefits become optional. These changes apply across Ontario automobile policies and will require nonprofit leaders to take a closer look at their driver screening practices.
While employees or volunteers may still be permitted to drive and carry valid auto insurance, the scope of their accident benefits coverage protection may no longer be what it had been in the past. For nonprofits, that means it is no longer enough to confirm that a staff member or volunteer has auto insurance. Leaders should also ensure that there is a formal driver approval process, a clear record of who is authorized to drive, and an understanding that staff and volunteer personal auto protection may be more limited than expected after the 2026 reforms.
Cyber risk: A growing threat for nonprofits
Cyber risks continue to be one of the biggest threats across all industries, but especially for nonprofits. Due to the collection of sensitive information such as client records, donor data and banking information, nonprofits are a big target for cybercriminals.
Most traditional commercial insurance policies are designed to protect physical assets, not virtual property such as data or installed software. This is why cyber liability insurance is essential to protect your organization against:
- Financial and data losses
- Business interruption
- Cyber extortion
- Legal and reputational recovery expenses
Quick cyber risk management steps for nonprofits
Having a robust cyber risk management program is key to protecting your organization from cyber threats. Some simple steps include:
- Regular phishing tests and training for staff and volunteers.
- Implementing technical controls like multi-factor authentication and secure password practices.
- Conducting regular reviews and security audits with cybersecurity professionals.
- An incident response plan in place for a data breach.
Cyber risks are no longer relegated to an IT issue — they are now a core organizational risk and should be treated as one.
“Nonprofits have an obligation to safeguard sensitive data and report breaches. Cyber risks should be a key component of every organization’s risk management strategy.”
– Mark Falcioni
Business interruption: Planning beyond the immediate loss
What would happen if your organization experienced a total loss such as a flood or fire that destroyed your entire building? The harsh reality is that recovery takes longer, and costs more, than many organizations expect.
When deciding on your business interruption coverage, many organizations underestimate their recovery timelines and the cost it would take to rebuild. In the case of a covered loss, you need to consider the soft costs associated with construction and how long a rebuild will take. These include:
- Property taxes
- Project planning
- Debris removal
- Supply chain delays
- Insurance premiums
- Permits and design fees
- Inflation
Even in the best circumstances, a large-scale construction project can be prone to delays. This is why it’s important to factor in how long an indemnity period you may need. Typically, we recommend at least 18 months.
Building a resilient insurance strategy
At Acera Insurance, we know that every dollar counts in the nonprofit sector, which is why we collaborate with our clients to come up with the best, most cost-effective solutions that can meet your needs. We want you to be able to focus on what you do best, supporting the clients who need your help.
As your insurance advisor, a key part of my role is to:
- Assess the highest-risk exposures tied to your service delivery and find gaps in coverage.
- Work with you to understand the non-negotiable coverages that you need to keep the doors open (such as abuse liability insurance).
- Review your contractual obligations and layer in coverage strategically.
- Use package enhancements, when possible, to strengthen your insurance coverage while factoring in costs.
At Acera Insurance, we help nonprofits prioritize their insurance portfolio based on organizational impact — not just cost. The right insurance program will reflect real-world risks, evolve with your organization and support long-term sustainability.
Connect with an Acera Insurance advisor to discuss insurance strategies and risk management for your nonprofit organization.
FAQ’s
Acera Insurance’s Mark Falcioni answers five questions about how nonprofits should approach their insurance strategy.
Nonprofits face unique risks based on the services they provide, the people they support and how they operate. Standard insurance policies may not fully address exposures such as professional liability, abuse claims, cyber incidents or business interruption, which can leave important gaps in coverage.
Some of the most common gaps include professional liability, cyber liability, abuse coverage and adequate business interruption or property limits. Many organizations assume their general liability policy will cover everything, but that is often not the case.
General liability helps protect against claims involving bodily injury, property damage and certain operational risks. Professional liability is designed to cover claims related to negligence in the delivery of professional services or advice.
For nonprofits that work with vulnerable populations, abuse coverage can be critical. Claims can be triggered by allegations, not just proven acts, and the coverage can help with defence costs, investigations and reputational harm. Strong policies, staff training and documentation also play an important role in reducing risk.
A strong risk management approach can help nonprofits reduce exposures and strengthen their overall insurance position. This may include annual risk assessments, abuse prevention training, driver screening, cybersecurity protocols and training, and strategic planning for business interruption including recovery timelines. Nonprofits with effective risk management programs do not simply implement these protocols once — they continually monitor them, test them and adapt them as circumstances change.
Related reading
- Non-Owned Auto Insurance Explained: Essential Coverage for Employers
- Risk management for faith-based organizations| Acera Insurance
Mark Falcioni is a Client Executive with Acera Insurance who specializes in supporting nonprofit and community-based organizations navigate risk with confidence. With a background supporting clients in developmental services, education, and the nonprofit sector, he brings a practical, people-first approach to complex coverage and risk matters.
Mark is valued for his ability to turn technical insurance and risk challenges into clear, strategic guidance. He partners with boards, executive teams, and nonprofit leaders across Canada to support informed decision-making and resilient risk management strategies that protect both operations and mission delivery.
Connect with Mark at 905.798.4791 or at mark.falcioni@acera.ca
Information and services provided by Acera Insurance, Acera Benefits and any other tradename and/or subsidiary or affiliate of Acera Insurance Services Ltd. (“Acera”), should not be considered legal, tax, or financial advice. While we strive to provide accurate and up-to-date information, we recommend consulting a qualified financial planner, lawyer, accountant, tax advisor or other professional for advice specific to your situation. Tax, employment, pension, disability and investment laws and regulations vary by jurisdiction and are subject to change. Acera is not responsible for any decisions made based on the information provided.