The first 48 hours after an incident: a claims guide

What you do in the two days after a fire, theft, accident or cyber event can shape how the claim is assessed. A guide to the first 48 hours.

Whether it is a shed fire, a stolen ute, a vehicle accident, a workplace injury or a cyber incident, the first two days after an event tend to set the tone for the entire claim. By the time the loss adjuster arrives or the insurer's claims team picks up the file, the scene has usually been altered, witnesses have moved on, and the version of events that gets recorded is the version that was written down – or not written down – in those early hours.

The good news is that a small amount of structured action in the first 48 hours can protect the people involved, preserve evidence and support the claim process. The following is the sequence we walk clients through.

Hour zero to two: make people and the scene safe

Before anything else, attend to safety. Get people clear of fire, livestock, machinery, flood water or any continuing hazard. Call 000 where life, property or the environment is at risk. For workplace injuries, follow your first-aid procedures and notify the relevant regulator if the incident is notifiable under work health and safety law.

Once the immediate danger is contained, secure the site. Lock gates, tape off damaged areas, isolate power where safe to do so, and prevent further loss – a tarp over a damaged roof, a guard on a broken window, livestock moved to a safe paddock. Insurers generally expect reasonable steps to mitigate further loss, and many policies include conditions around this.

Hour two to twelve: notify the right people

Once safety is in hand, notification begins. For a fire or major property loss, that means the fire service report number where one was issued. For theft, malicious damage, or any criminal act, that means a police event number – most insurers require one before a theft claim can be processed. For a vehicle accident, exchange details and obtain a police report number where one is available.

“The first 48 hours can make a major difference to what can be proven, documented and assessed during the claim.”

Then call your broker as early as possible. A short phone call at this stage lets the broker triage the event, identify which policy or policies may be relevant, flag any time-sensitive notification obligations, and start the formal claim process on the right footing. For cyber incidents in particular, the broker can help engage the policy’s incident response panel quickly, where the wording requires or allows that process.

Hour twelve to twenty-four: preserve evidence

Before anything is cleaned up, moved or repaired, document the scene. Photograph and video the damage from multiple angles, including wide shots that establish context and close-ups that show specific damage. Capture serial numbers, asset tags, registration plates and any markings that identify what was lost or damaged. Keep damaged items where they are unless safety or further loss requires moving them – adjusters often want to inspect the item.

Collect witness details while memories are fresh. Names, phone numbers, and a short written note of what each person saw. For workplace incidents, secure CCTV footage before it is overwritten on the standard retention cycle, which on many systems is as short as seven days.

Day one to two: build the paper trail

By the end of the first day, the claim file should be starting to take shape. A short written timeline of what happened, when, and who was involved. Copies of any reports – police, fire, ambulance, regulator. Photographs and videos stored somewhere safe and backed up. Invoices, valuations or schedules that establish what was lost. For business interruption, a note of the date and time operations were affected, and what is being done to resume trading.

Track every dollar spent in response to the loss. Emergency repairs, temporary accommodation, hire equipment, additional labour, freight. Some of these costs may be recoverable under the policy as costs incurred to mitigate further loss or as additional cost of working, depending on the wording and the documentation available.

Mistakes that can affect claims

A handful of avoidable mistakes turn up repeatedly. Cleaning up or repairing before the insurer has inspected the damage. Disposing of damaged stock or equipment without photographs or an itemised list. Admitting fault at the scene of a motor accident or a liability incident. Speaking to the other party's insurer or lawyer without first speaking to your own broker. Delaying notification because the loss looks small – and discovering later that it is not.

For cyber events specifically, two further mistakes are common. Paying a ransom or engaging an unapproved incident response provider before the insurer is notified, which may affect the policy position depending on the wording and circumstances. And restoring systems from backup before forensic evidence is captured, which can frustrate both the claim and any subsequent regulatory investigation.

When to call the broker, not the insurer

For any incident likely to result in a claim, it is usually worth calling the broker as early as possible. The broker can lodge the notification, identify the most relevant policy under which to lodge it, and ensure the wording is reviewed carefully on the client’s behalf from the outset. Calling the insurer’s general claims line direct can sometimes result in the claim being routed by topic rather than by the most relevant wording, and small details in the first notification can be difficult to correct later.

If you would like to review how claims would be managed under your current insurance program, including who to call first, what records to keep and how urgent incidents should be notified, RMA Insurance Brokers can walk through it with you before renewal.