Workplace misconduct rarely walks through the front door and announces itself. It does not arrive with a warning label, a memo from leadership, or a line item on a risk register. Instead, it builds quietly — in the margins of an organization where supervisory oversight is thin, accountability structures are unclear, reporting channels go unused, and a culture of silence slowly takes root.

By the time misconduct surfaces as a formal complaint, an EEOC charge, a lawsuit, or a regulatory action, the conditions that allowed it to develop have usually been present for months, sometimes years. And when it does surface, the financial consequences for a business are far broader than most owners and executives anticipate — reaching across insurance premiums, legal defense costs, operational stability, employee retention, and the organization’s long-term insurability.

For businesses of any size, understanding how misconduct in the workplace originates, escalates, and ultimately intersects with your commercial insurance program is no longer optional. It is a foundational element of responsible risk management.

The Data Is Speaking — and Businesses Need to Listen

The numbers surrounding workplace misconduct are not abstract. They are current, significant, and trending in the wrong direction for employers who are not actively managing this risk.

According to HR Acuity’s 2025 Workplace Harassment and Misconduct Study — conducted in partnership with Isurus Market Research and Consulting based on a survey of 2,043 U.S. employees — 55% of employees said they experienced or witnessed serious workplace misconduct in 2025. That is a 14-point increase from 41% in 2024, and it marks the highest reported rate since 2018.

After five consecutive years of steady decline following the #MeToo movement, misconduct is rising again — sharply.

What makes this data even more significant for businesses from a risk and insurance standpoint is not just the volume of incidents. It is the complexity.

The same study found that 38% of affected employees dealt with four or more distinct types of misconduct in a single year, up 14 points from 2024. Cases that once came in as a single allegation now arrive layered — a workplace conflict carrying a discrimination claim underneath, or a policy violation with retaliation undertones attached. Complex cases take significantly longer to investigate, cost more to resolve, and carry materially higher legal risk.

The Equal Employment Opportunity Commission’s FY 2024 Annual Performance Report reinforces this picture from a regulatory enforcement standpoint. In Fiscal Year 2024, the EEOC received 88,531 new charges of workplace discrimination — a 9.2% increase from Fiscal Year 2023, and the third consecutive year of rising charges. Retaliation remained the most frequently cited allegation for the seventeenth consecutive year. The EEOC recovered $700 million for workers in 2024, including over $40 million in litigation claim awards alone — the largest recovery in the agency’s recent history.

For context, consider what these figures mean at the individual business level. According to data published by Berkley Asset Protection:

• The average cost to defend even a nominal employment practices claim is $10,000
• Median settlement values reach $90,000
• Cases that proceed to a jury verdict average over $300,000 in damages
• Even dismissed claims generate real costs in legal fees, management time, and organizational disruption

Workplace misconduct is also a retention and productivity crisis hiding inside an HR file. According to the State of Misconduct at Work report from Fama Technologies, toxic workplace cultures cost U.S. companies $223 billion in turnover costs over a five-year period. That is not a soft number. It is a direct, documented financial consequence of failing to address behavioral risk early.

Why This Is an Insurance Problem, Not Just an HR One

Many business owners treat misconduct as a human resources matter — reaching for a policy manual, assigning the issue to an HR manager, and moving on. That instinct is understandable. It is also dangerously incomplete.

Workplace misconduct is a commercial insurance problem. It touches multiple lines of coverage simultaneously, and how well or poorly an organization manages its internal controls directly determines how it is priced, underwritten, and — in serious cases — whether it remains insurable at the limits it needs.

Here is where misconduct creates specific insurance exposure across a business’s commercial program:

Employment Practices Liability Insurance (EPLI)

This is the most direct line of exposure. EPLI covers claims arising from harassment, discrimination, wrongful termination, retaliation, failure to promote, and related employment practices violations. According to the EEOC, retaliation and harassment together accounted for more than 88% of all charge categories filed in FY 2024.

Businesses without EPLI — or with EPLI limits that haven’t been reviewed alongside claims trends — are carrying significant uninsured exposure. According to Embroker’s EPLI research, employment-related lawsuits have risen roughly 400% over the past two decades, and nearly half of all employment-related legal cases are brought against companies with fewer than 100 employees. Small and mid-sized businesses are not protected by their size. They are often more exposed because of it.

Directors & Officers (D&O) Liability

D&O exposure becomes relevant when misconduct involves leadership-level failures that expose the organization to claims of governance negligence.

In January 2026, the Delaware Court of Chancery issued a precedent-setting ruling in Los Angeles City Employees’ Retirement System v. Glenn Sanford, et al., C.A. No. 2024-0998-KSM (Del. Ch. Jan. 16, 2026), involving eXp World Holdings Inc. Chancellor Kathleen J. McCormick denied motions to dismiss claims against certain directors and officers, ruling that the board’s failure to respond in good faith to clear red flags of workplace sexual misconduct — and the CEO’s concealment of that misconduct — gave rise to viable breach of fiduciary duty claims under Delaware law.

As analyzed by Harvard Law School’s Forum on Corporate Governance, this ruling is expected to increase underwriting scrutiny on oversight failures and may drive coverage disputes over defense-cost advancement and indemnification in derivative actions. For businesses where leaders are named in suits — or where governance failures allow misconduct to persist — D&O coverage is a critical but easily overlooked layer of protection.

Commercial Crime and Fidelity Insurance

This coverage addresses a form of misconduct that is often misunderstood: financial wrongdoing by employees. Embezzlement, internal theft, forgery, wire transfer fraud, and other forms of employee dishonesty represent a significant and chronically underinsured risk.

According to AIG’s Crime and Fidelity Insurance overview, crime-related losses are typically not covered under commercial property insurance — making a standalone crime or fidelity policy essential for organizations that process payments, handle client funds, or operate with meaningful financial access distributed across staff. Internal crimes frequently begin with small-scale testing of controls before escalating, a pattern that strong internal oversight is specifically designed to interrupt.

Professional Liability / Errors & Omissions (E&O)

E&O enters the picture when misconduct produces professional failures — situations where negligent conduct, poor judgment, or inappropriate behavior in the delivery of services results in client harm. Organizations where misconduct goes unaddressed tend to also have weaker quality oversight, weaker client service protocols, and higher error rates. The connection between internal accountability culture and E&O exposure is direct.

Cyber Liability

Cyber liability is increasingly relevant as misconduct extends into digital environments. Unauthorized system access, deliberate data misuse, and insider threats with malicious intent all carry cyber liability implications. As Fama Technologies’ benchmark research notes, governments globally are now expanding definitions of workplace misconduct to include online behaviors, reflecting the increasingly digital nature of how misconduct occurs and spreads.

The through-line connecting all of these coverage lines is this: underwriters evaluate internal controls when they price and renew your commercial program. Businesses that can demonstrate structured policies, trained management, functioning reporting systems, and a documented track record of addressing misconduct promptly present a materially different risk profile than those that cannot.

Where Internal Controls Break Down — and Why It Matters for Coverage

Strong internal controls do not collapse all at once. They erode incrementally, through predictable patterns that organizations can identify and correct — if they are paying attention. Understanding where controls typically fail is the first step toward building the ones that protect both people and the business.

Inconsistent Policy Enforcement

Written policies that are selectively enforced create two problems simultaneously.

The first is legal: inconsistent application of disciplinary standards becomes a central exhibit in employment claims. If a similarly situated employee received no discipline for a behavior that resulted in another employee’s termination, that inconsistency is exactly what plaintiffs’ attorneys look for — and what juries react to.

The second is cultural. When employees observe that policies apply differently depending on seniority or relationships with leadership, the implicit message is that behavior standards are negotiable. That perception undermines every policy document a business has ever published.

From an underwriting standpoint, EPLI carriers specifically evaluate consistency of enforcement when assessing a business’s risk profile. Organizations with documented, uniform disciplinary processes present significantly lower risk.

Inadequate or Inaccessible Reporting Channels

The 2025 HR Acuity study found that 22% of employees who experienced or witnessed misconduct said nothing. For hourly workers, that number was significantly worse — only 63% of hourly employees reported concerns, compared to 97% of executives.

This matters not just because unreported misconduct continues unaddressed, but because it concentrates legal risk. When misconduct later surfaces through a regulatory complaint or lawsuit, the absence of internal reports does not help the organization — it becomes evidence that reporting mechanisms were insufficient, inaccessible, or feared to be punitive.

According to SHRM’s risk management guidance, organizations should provide multiple reporting pathways: direct supervisor access, HR channels, anonymous intake mechanisms, and third-party hotlines where appropriate. Non-retaliation protections need to be explicitly stated, regularly communicated, and demonstrably enforced.

Supervisory Training Gaps

Supervisors occupy a uniquely high-risk position in the misconduct landscape. They are simultaneously the most likely source of harassment and discrimination claims, the first line of detection for behavioral problems involving others, and the first point of organizational response when a concern is raised.

When supervisor training is absent or limited to a single onboarding event, all three of those functions break down.

HR compliance research from Paradigm consistently identifies regular, role-specific manager training as one of the most cost-effective risk reduction measures available to businesses — including training on recognizing behavioral red flags, responding appropriately, documenting disciplinary conversations, and understanding what not to do when an employee raises a concern informally.

Managers who investigate, dismiss, or retaliate — even without intending to — frequently become the named subject in retaliation claims, which remain the most commonly filed EEOC charge category for seventeen consecutive years.

Documentation Failures

When misconduct claims are contested, documentation often determines the outcome.

Organizations that maintain thorough, contemporaneous records of performance issues, disciplinary conversations, investigation steps, and final determinations are in a fundamentally different position than those whose HR files are sparse or constructed after the fact.

Documentation also matters for the insurance claim itself. EPLI carriers reviewing a claim will examine what the organization knew, when it knew it, what it did in response, and how thoroughly those steps were recorded. Weak documentation creates ambiguity — and in employment litigation, ambiguity tends to favor the claimant.

Tone at the Top — and Accountability at Every Level

Organizational culture is not a soft concept. It is measurable, and it has a direct effect on claims frequency.

The LACERS v. Sanford decision, as analyzed by Akin Gump and Cohen & Gresser, makes clear that oversight obligations extend well beyond financial reporting into workplace culture and employee safety. When boards and senior leaders fail to respond to red flags, they create downstream exposure that extends well beyond the original behavior into governance liability.

The same principle applies at every level. When managers observe misconduct and do nothing, when HR deprioritizes investigation timelines, or when leadership tolerates behavior that falls short of policy standards as long as business results are strong, the organization is building a claims history it has not yet filed.

The Specific Coverages Businesses Need to Review

Given the landscape above, businesses should be evaluating their commercial program not just at renewal, but as an active reflection of how their internal risk environment is actually functioning.

Employment Practices Liability Insurance (EPLI)

Review limits relative to workforce size, industry, and geography. According to The Miller Group’s EPLI trends analysis, the average cost of defense in an EEOC claim is approximately $75,000, with average settlements ranging from $5,000 to over $100,000 depending on the allegations and jurisdiction. California, New York, and other high-litigation states carry materially higher risk profiles and require higher limits accordingly.

Also confirm whether the policy covers third-party claims, that prior acts coverage is in place, and that deductibles are calibrated relative to realistic defense costs for even nominal claims.

Directors & Officers Liability (D&O)

For organizations where senior leadership or board members could be named in claims arising from governance failures or oversight of misconduct, D&O coverage is not optional. Review whether policy language addresses oversight risk and cultural compliance failures, particularly in light of the LACERS v. Sanford ruling and the evolving Caremark liability framework.

Commercial Crime / Fidelity Coverage

Most commercial property policies do not cover employee dishonesty or financial misconduct. If your organization lacks a standalone commercial crime policy or a fidelity bond, you have an uncovered gap. This is particularly relevant for any business with employees handling finances, transactions, or client assets.

Professional Liability / E&O

If your business delivers professional services, the nexus between internal conduct standards and E&O exposure is direct. Review policy limits and exclusions alongside any known weaknesses in your internal accountability structure.

Cyber Liability

Review whether the policy addresses insider threats and deliberate data misuse, not just external attacks. As employee behaviors extend further into digital systems, the traditional framing of cyber liability as an external-threat-only product is insufficient.

For organizations that want to understand how their full commercial program maps to their actual risk exposures, the Commercial Insurance and Risk Management Services page provides a structured starting point for that analysis.

Building Internal Controls That Actually Reduce Risk — and Reduce Claims

Effective internal controls share a common set of characteristics. They are written, consistently enforced, regularly reviewed, actively communicated, and documented in ways that hold up under regulatory and legal scrutiny.

Comprehensive, Updated Written Policies

Employee handbooks, codes of conduct, and specific anti-harassment and anti-retaliation policies are the structural foundation of an internal control framework. These documents should be reviewed annually, updated to reflect changes in applicable law, distributed to all employees, and acknowledged in writing.

Outdated policies create compliance gaps that are difficult to defend. The Pregnant Workers Fairness Act, for example, generated 2,729 EEOC charges in its first full year of full enforcement in FY 2024 — up from just 188 charges in 2023. Businesses that had not updated policies to reflect the Act’s requirements were exposed from day one.

Multi-Channel Reporting Systems

Employees need more than one way to raise a concern. A single HR contact is not a reporting system — it is a single point of failure.

Effective reporting infrastructure includes direct supervisor pathways, HR department access, anonymous intake mechanisms, and potentially third-party ethics hotlines. Non-retaliation protections must be explicitly stated, regularly communicated, and demonstrably enforced. When employees fear that reporting will harm their standing, they stay silent — and organizations lose their most valuable early warning signal.

Manager Training, Documented and Regular

Role-specific training for supervisors and managers is one of the highest-return investments a business can make in misconduct prevention.

It should cover recognition, response, documentation, and escalation procedures. It should be repeated at meaningful intervals — not delivered once at onboarding and never revisited. Completion should be tracked and documented. When an EPLI claim arrives and the first question is “what training did your managers receive, and when,” that documentation is the difference between a defensible position and an expensive settlement.

Structured Investigation Protocols

When a concern is reported, the quality and consistency of the organizational response determines whether the situation resolves or escalates.

Investigation protocols should be clearly defined, followed consistently, and conducted by individuals with appropriate training and independence from the subject of the complaint. According to Work Shield’s misconduct management research, the average EEOC charge took approximately 11 months to investigate and resolve — nearly a year of organizational risk exposure. Early, competent internal investigation is consistently the most effective path to faster, lower-cost resolution.

HR Support Infrastructure

For businesses without full internal HR capability, access to professional HR consultation on demand is a practical risk management tool.

Ensuring that sensitive employee situations are handled by people with the expertise to navigate them — rather than managers improvising under pressure — meaningfully reduces the frequency of escalation into formal claims. Infinity Insurance Partners offers clients access to an HR Hotline and business risk reduction tools specifically designed to support proactive operational risk management. These are structural controls that directly affect your claims performance and insurance renewal outcomes.

Regular Policy and Culture Audits

Internal controls that are never reviewed become outdated controls — and outdated controls do not protect organizations.

Annual policy audits, periodic HR record reviews, and regular culture assessments give organizations the ability to identify gaps before they become claims. HR compliance guidance from Connect2BPO consistently identifies proactive auditing as foundational best practice, noting that identifying and addressing issues before they escalate is substantially less expensive than managing them after the fact.

The Connection Between Misconduct Prevention and Long-Term Insurance Program Performance

There is a direct and measurable relationship between how effectively an organization manages misconduct in the workplace and how it performs from an insurance standpoint over time.

Businesses that invest in structured internal controls — not as a compliance checkbox, but as an operational discipline — typically see fewer EPLI claims, lower defense costs when claims do occur, stronger negotiating positions at renewal, and access to broader coverage at more favorable terms. They also tend to have better workforce stability, lower turnover, and higher productivity — all of which reduce the indirect costs that compound behind every formal claim.

Businesses that do not invest in these controls tend to have the opposite experience. Rising claims frequency drives higher premiums. A poor prior claims history becomes a central underwriting factor. Coverage restrictions tighten. And what began as a manageable internal issue — an unreported harassment concern, a supervisory overreach, a pattern of discriminatory treatment that was never addressed — becomes a multi-year insurance and legal problem that costs far more than any prevention investment ever would have.

The SHRM, the EEOC, and HR Acuity all point to the same conclusion: early detection, consistent enforcement, and credible reporting systems are the most effective tools available for keeping misconduct from escalating — and the tools that underwriters reward when evaluating your program.

How This Connects Directly to Your Insurance Program

Workplace misconduct does not stay contained to the incident. It escalates into claims, investigations, regulatory exposure, and reputational damage. The organizations that manage it most effectively are those that have built the internal controls, the coverage, and the operational infrastructure to prevent escalation before it begins.

Infinity Insurance Partners works with businesses to align their commercial insurance programs with their actual risk environment — including the misconduct exposures that most standard renewals fail to adequately address. That means structuring EPLI, D&O, crime, professional liability, and cyber coverage around how an organization actually operates, evaluating internal controls for gaps that affect claims frequency and insurability, and treating the commercial insurance program as an active component of how a business protects its people, its operations, and its financial future.

If your organization has not conducted a full review of its employment practices liability coverage, its internal reporting infrastructure, or the alignment between its risk management practices and its commercial insurance program, now is the time to start that conversation.

Contact our team to discuss how your current risk controls align with your coverage — and where there may be gaps worth addressing before they become claims.

This blog is intended for general informational purposes and does not constitute legal or insurance advice. Coverage availability, terms, and requirements vary by state and circumstance. Consult a licensed insurance professional regarding your organization’s specific situation.