Today’s private equity environment puts a premium on speed, scale, and value creation.
Those dynamics, while potentially lucrative for private equity firms and their investors, can also increase crime risk for portfolio companies they own.
Portfolio companies often operate under decentralized controls and varying financial reporting processes. The emphasis on rapid growth can outpace internal controls, creating gaps in financial reporting and increasing the risk of misconduct and employee theft.
These same structural pressures also heighten exposure to external threats, as decentralized controls and accelerated transaction cycles make portfolio companies more susceptible to social engineering and funds transfer fraud.
These risks can have significant downstream implications, complicating operations, eroding financial performance, and jeopardizing exit timelines. In severe cases, they can impair valuations or derail transactions entirely.
A proactive approach to crime insurance, supported by robust internal controls, helps protect enterprise value across the portfolio. By aligning insurance coverage with evolving risk exposures and reinforcing consistent governance practices, sponsors can meaningfully reduce both the likelihood and severity of losses.
What does crime fraud look like for portfolio companies?
Unlike publicly traded companies, most private equity portfolio companies are not required to disclose crime-related losses, making the true scale of financial crime difficult to quantify. However, crime claims consistently demonstrate that these incidents are far from isolated and can affect businesses of any size, sector, or stage of ownership.
For private equity sponsors, crime losses extend well beyond the immediate financial impact. They can disrupt operations, trigger regulatory scrutiny, damage customer and lender confidence, delay strategic initiatives, and create friction during refinancing or exit processes. In many cases, the costs associated with investigating and remediating an incident can significantly exceed the value of the initial loss.
Crime events frequently arise through seemingly routine business activities, where trusted payment processes, vendor relationships, or employee access are exploited by either sophisticated external actors or dishonest insiders. As portfolio companies grow, acquire new businesses, or integrate systems, these exposures can become increasingly difficult to detect without dedicated controls and appropriately structured insurance protection.
Common crime losses experienced by portfolio companies include:
Employee theft and dishonesty: Without proper oversight, portfolio companies are prone to deception from underhanded employees. These employees can exploit misplaced trust and financial reporting gaps to concoct schemes, such as creating fake vendors or bogus invoices that divert company funds to their personal accounts. Other fraud schemes can involve payroll fraud, such as skimming withholding taxes or paying nonexistent or former employees, as well as accounting manipulation to cover up the behavior. These deceptions can often go undetected for years. Losses from these incidents can range from $150,000 to more than $1 million.
Social engineering fraud: These scenarios do not rest with dishonest employees, but with those who get tricked into transferring company funds to an outside imposter. Common variations of these schemes include impersonating a company executive, vendor, or lender and instructing an employee through email to wire funds to an unauthorized account. Artificial intelligence has made these ploys more convincing and harder for even conscientious employees to spot. These losses can range from $250,000 to $5 million or more.
Funds transfer fraud: Similar to social engineering fraud, these schemes begin when a threat actor gains access to an employee’s login or network credentials — usernames, passwords, etc., allowing them to access internal systems and transfer funds to the criminal’s accounts. Weak internal controls and noncompliance with network security protocols can allow funds transfer fraud to occur without immediate detection. Typical losses range from $150,000 to $1 million or more.
How crime insurance can help
Commercial crime insurance plays a critical role in mitigating financial loss, but coverage is frequently misunderstood or inadequately structured. As portfolios grow and transaction complexity increases, insurance programs can develop gaps that leave both sponsors and portfolio companies exposed. Common issues include:
Sub-limited or excluded coverage for social engineering fraud.
Inadequate policy limits relative to transaction size or add-on activity.
Gaps in coverage for losses occurring prior to the portfolio company’s acquisition but not discovered until after the deal closes.
Alongside appropriate insurance, private equity sponsors should also strengthen their operational resilience by:
Conducting crime risk assessments both annually and at the time of an acquisition.
Standardizing minimum controls across the portfolio and applying portfolio-wide risk frameworks.
Aligning crime insurance limits and endorsements to the size and scope of the portfolio’s risk.
Implementing dual-authorization protocols for all fund transfers so that more than one employee signs off before funds leave a company’s control.
By aligning coverage with evolving risk exposures and implementing consistent governance practices, sponsors can materially reduce crime-related losses.
Lockton brings deep expertise in private equity risk management, helping firms and their portfolio companies assess vulnerabilities, designing bespoke crime insurance programs, and closing critical coverage gaps that traditional off-the-shelf placements often overlook.
For more information or insights, please visit:
Our crime insurance page here (opens a new window).
Our private equity page here (opens a new window).
Alternatively, reach out to your usual Lockton contact.