Skip to main content

What's The Difference Between The Discovery Form And The Loss Sustained Form?

by
Last updated on 9 min read

The discovery form covers losses discovered during the policy period regardless of when the crime occurred, while the loss sustained form only covers losses that both occurred and were discovered during the policy period (or within one year after).

Which commercial crime policy covers any occurrence that took place during the policy even if it wasn't immediately discovered?

A loss sustained form policy covers losses that occurred during the policy period even if they were not discovered until after the policy expired, provided the loss is reported within one year.

Here's the thing: a loss sustained policy works like an "occurrence" policy—it protects against crimes that happen anytime you're covered, even if you don't notice the damage until later. Take this scenario: an employee embezzled $50,000 in December 2025 but you only found out in March 2026. A loss sustained policy issued in 2025 would still cover it if reported by December 2026. That's different from the discovery form, which only covers crimes discovered during the policy period, no matter when they actually happened.

Which of the two crime insurance policy forms requires the use of a retroactive date?

The discovery form typically requires a retroactive date, while the loss sustained form does not.

Now, the retroactive date defines how far back in time a loss can occur and still be covered under a discovery form policy. Say your policy has a retroactive date of January 1, 2020, and you purchase coverage in 2026. Any crime discovered in 2026 that happened after January 1, 2020 could be covered. Without one, the discovery form would only cover crimes discovered during the policy period with no historical coverage. The loss sustained form, on the other hand, only cares about when the loss occurred and was discovered—not how far back the crime went.

What is a discovery form in insurance?

A discovery form covers losses discovered during the policy period, regardless of when the underlying crime occurred.

Think of it like shining a flashlight—you're covered for anything the light touches during the policy term. For example, if an employee stole $20,000 in 2020 but you only discovered it in 2026 while your discovery policy is active, the loss would be covered (assuming no retroactive date excludes pre-2026 crimes). Honestly, this is the best approach for businesses upgrading coverage or switching insurers. Just watch for policy exclusions like prior acts or uncovered entities—they can limit your protection.

Which of the following commercial crime insuring agreements provides coverage if a company accountant steals money by signing a Businessowner's name on a $1000 check?

Coverage would come from the Forgery or Alteration insuring agreement, which protects against the forgery or alteration of checks drawn by the insured or on their behalf.

This agreement specifically covers situations like an accountant signing the business owner's name on a check without authorization. The key is the unauthorized signature or alteration of a financial instrument. If the accountant simply stole cash without forging documents, the Employee Theft insuring agreement would apply instead. Always check your policy's definitions—some forms exclude losses involving family members or business partners unless specified otherwise.

Which is better: loss sustained vs discovery?

Choose loss sustained if you want coverage for crimes that occurred during the policy period (even if discovered later), and discovery if you need protection for crimes discovered during the policy period regardless of when they happened.

That said, the best choice depends entirely on your risk profile and coverage history. Loss sustained is straightforward—it covers crimes that happen while you're insured, even if you don't find out until up to a year after the policy ends. Discovery is broader but requires careful management of retroactive dates and prior acts. For a new business, discovery might offer better historical protection. For a business with consistent coverage, loss sustained could be simpler and more predictable. Don't forget to compare premiums—discovery forms often cost more due to the broader coverage scope.

What is a retro date?

A retroactive date is the earliest point in time a loss can occur and still be covered under certain policy forms, typically used in discovery and claims-made policies.

For example, if your policy has a retroactive date of January 1, 2024, any claim arising from a crime committed before that date won't be covered—even if discovered during the policy period. This prevents "gap coverage" between old uninsured losses and new policies. Retro dates are common in professional liability insurance but also appear in some crime policies. Always review this date carefully—it's usually set during underwriting and can sometimes be negotiated upward to reduce premiums.

Is extortion a crime?

Yes, extortion is a criminal offense involving the unlawful obtaining of money, property, or services through threats, coercion, or intimidation.

Extortion is a felony in most jurisdictions and can involve physical threats, threats to reveal damaging information, or threats to harm property. Cyber extortion, where hackers threaten to release data unless paid, has become increasingly common since 2020. According to the FBI, extortion schemes resulted in over $107 million in losses in 2023 alone in the U.S. Victims should report extortion to law enforcement immediately—insurance policies with extortion or cyber extortion coverage may reimburse ransom payments or related losses.

What is money extortion?

Money extortion is a specific type of extortion where the perpetrator unlawfully obtains cash or financial assets from a victim through coercive threats or force.

This can include demands for payment to prevent harm, to return stolen property, or to keep secrets. For instance, a hacker encrypting your company's files and demanding $50,000 to decrypt them is committing money extortion. While extortion doesn't require actual money to change hands—the threat itself is the crime—it often ends with the victim paying to avoid damage. Some commercial crime policies include extortion coverage for ransom payments, crisis management, or legal expenses.

What is a loss sustained form?

A loss sustained form covers crimes that both occurred and were discovered during the policy period, or within one year after the policy expires, whichever comes first.

This is the traditional crime insurance form, used for decades in commercial policies. It's ideal for businesses with continuous coverage, as it protects against crimes happening while insured. For example, if employee theft occurred on November 15, 2025, and was discovered on January 3, 2026 (within the 12-month reporting window), it would be covered by a 2025 policy. Just be aware: if you cancel the policy and switch to a discovery form later, uncovered prior acts could leave gaps.

What is a discovery policy?

A discovery policy covers claims made during the policy period, regardless of when the underlying incident occurred, often called a claims-made policy.

This contrasts with occurrence-based policies, where the timing of the incident matters. Discovery policies are common in professional liability (like E&O insurance) and cyber liability. For example, a claim filed in 2026 for a data breach that happened in 2020 could be covered if you had an active discovery policy in 2026. But beware of retroactive dates and prior acts exclusions—they can limit historical coverage. Always align your policy with your risk timeline.

What is coverage trigger?

A coverage trigger is the specific event or condition outlined in a policy that must occur for the insurer to provide coverage for a loss.

In crime insurance, the trigger could be the discovery of a loss (discovery form) or the occurrence of a crime during the policy period (loss sustained form). For example, under a discovery policy, the trigger is the moment you first become aware of the loss. Courts use legal theories like the "exposure theory" or "manifestation theory" to determine when a trigger occurs in complex cases. Understanding your policy's trigger is crucial for reporting claims correctly and avoiding disputes.

What is a discovery form?

In the context of insurance, a discovery form refers to a policy that covers losses discovered during the active policy period, regardless of when the underlying crime occurred.

This is different from a discovery form used in litigation, where it's a pre-trial process to share evidence. In insurance, the discovery form focuses on when you *find out* about a loss, not when it happened. For instance, if a former employee stole inventory in 2024 but you only discovered it in 2026 while your policy is active, the discovery form would cover it (assuming no retroactive date restriction). Always pair this with a strong record-keeping system—timely discovery is key to coverage.

Which one of these exclusions applies only to the employee theft Insuring Agreement?

The inventory shortage exclusion applies only to the employee theft insuring agreement.

This exclusion prevents coverage for losses proven solely by inventory discrepancies or profit-and-loss calculations. For example, if your books show $10,000 missing but you can't pinpoint who took it or when, the inventory shortage exclusion may bar the claim. Other common employee theft exclusions include losses caused by vendors or customers, or acts committed outside the policy territory. Review your policy's definitions carefully—some insurers allow inventory shortage claims if supported by independent evidence like surveillance or witness statements.

Which of the following is covered under the Electronic Data Processing floater?

Computers and their components used exclusively in the insured's computer operations—such as hardware, systems, and supporting equipment like air conditioning or electrical systems—are covered under the Electronic Data Processing floater.

This floater is designed for businesses heavily reliant on technology, like data centers or IT firms. It typically covers physical damage to equipment from events like power surges, fire, or theft. Software, data, or intangible assets are usually excluded unless specifically endorsed. For example, if a lightning strike fries your server rack in 2026, the EDP floater would cover the hardware replacement—minus any deductible. Always verify whether your policy includes "data restoration" coverage, as that's often sold separately.

Which of the following would be included in the definition of burglary?

Burglary is defined as the unlawful entry into any structure with the intent to commit a crime inside, even if no physical force is used or no theft occurs.

This includes entering an open door with intent to steal, vandalize, or commit fraud. The key elements are unlawful entry and intent—no "breaking and entering" is required. For example, if a contractor enters an office after hours with the intent to steal client lists, that's burglary even if they leave empty-handed. Burglary coverage under commercial crime policies often requires visible signs of forced entry, though some insurers offer broader definitions. Always check whether your policy covers attempted burglary or only completed crimes.

Edited and fact-checked by the TechFactsHub editorial team.
Alex Chen

Alex Chen is a senior tech writer and former IT support specialist with over a decade of experience troubleshooting everything from blue screens to printer jams. He lives in Portland, OR, where he spends his free time building custom PCs and wondering why printer drivers still don't work in 2026.