By Matthew Mattingly, ARM
Most churches review their insurance policy once a year, sign the renewal, and move on to the hundred other things competing for an administrator’s attention.
That’s understandable — risk management isn’t why anyone got into ministry.
But in 20 years of working with religious institutions, the churches that get hurt aren’t usually the ones without coverage. They’re the ones whose coverage quietly stopped matching their actual operations, one small change at a time, until a claim exposed the gap.
None of the five issues below require a bigger budget or a risk management department. They require someone to ask the right question once a year.
Here’s where to start.
1. Volunteer screening that stops at ‘works with children’
Almost every church has a background-check process for anyone formally serving in children’s ministry. Far fewer have a policy that reaches everyone else who ends up in regular proximity to minors — greeters, ushers, worship team members, small group leaders, facilities volunteers, and lay leaders whose roles were never classified as ‘children’s ministry’ but who nonetheless have ongoing, unsupervised access to kids before and after services, at church-wide events, or through informal mentoring relationships.
This isn’t a hypothetical failure mode. It’s a pattern that shows up repeatedly in abuse cases involving churches: the individual causing harm held a role — general volunteer, lay leader, occasional helper — that sat outside whatever the congregation’s formal children’s ministry screening track was designed to cover. The specific facts vary case to case, but the structural gap is consistent.
The lesson isn’t that background checks fail. It’s that a policy scoped to job titles will always have edges, and access tends to find them — especially when nobody revisits the policy’s definition of ‘who counts’ as ministries and volunteer roles evolve.
Fix it: Write your child protection policy around proximity and opportunity, not job title — if a role puts someone in regular contact with minors, screen it, regardless of whether it’s officially a ‘children’s ministry’ position. Set a re-screening interval (most churches land on every two to three years) that applies to long-tenured volunteers and staff, not just new sign-ups, and periodically re-map which roles actually have access to kids, since that list changes as ministries grow. Confirm the policy is being followed in practice — not just written down — before your next insurance renewal conversation.
2. Property valuations that haven’t kept pace with construction costs
Rebuild costs have moved significantly over the past several years, and a lot of churches are still insured based on a valuation done before their last renovation, or before materials and labor costs climbed. The result is a coverage gap that nobody notices until there’s a claim — at which point being underinsured by even 20% on a total loss is a very expensive way to find out.
This is especially common after a church finishes a building project. The new square footage, upgraded finishes, or added wing often doesn’t make it into the policy’s insured value unless someone specifically updates it.
Fix it: Ask your agent when your property was last formally appraised or valued — not just renewed at the prior year’s number with an inflation bump. After any renovation, expansion, or major capital project, treat a valuation update as part of the project closeout checklist, not an afterthought.
3. Outside groups using the building without a real agreement
Renting or hosting space for community groups, sports leagues, 12-step programs, election polling, or another congregation is common, and it’s genuinely good for the church’s relationship with its community. It’s also one of the most frequently overlooked exposures. A verbal agreement or a friendly handshake doesn’t establish who’s responsible if someone is injured during that group’s use of the building, and many churches don’t realize their liability policy may treat outside-group use differently than their own church activities — particularly for higher-risk uses like youth sports or events with alcohol.
Fix it: Any group using your space regularly should sign a facility use agreement that addresses liability, and ideally should carry (and provide proof of) their own insurance naming the church as an additional insured. If you can’t remember the last time someone reviewed which outside groups are currently using your building, that’s worth doing before it becomes a problem.
4. Informal ministries operating without written protocols
Youth ministry, counseling, home visitation, and care ministries often grow organically — a pastor starts meeting with someone one-on-one, a small group leader starts driving students to events, a lay counselor takes on more serious situations than they were originally asked to handle. These ministries do real good, but as they grow past their original scope, they often outpace the written protocols meant to protect both the person receiving care and the church.
The specific gaps vary: two-adult policies for one-on-one youth interactions, guidelines for what counseling situations get referred to a licensed professional, protocols for who’s authorized to transport minors and in what vehicles. None of these require much to implement. What creates exposure is the absence of any written standard at all, because it leaves everyone — staff, volunteers, and the church itself — improvising in the moment a real problem shows up.
Fix it: Walk through your church’s ministries and ask, for each one, “if something went wrong here, is there a written protocol we followed, or would we be explaining after the fact what we normally do?” Any ministry where the honest answer is the second one is worth a policy, even a simple one.
5. Digital ministry and data exposure
Online giving platforms, livestreamed services, and member databases have become standard church infrastructure over the past several years, and most churches adopted them faster than they updated their risk planning to account for them. A data breach involving donor payment information or a congregant database isn’t hypothetical anymore — it’s a growing category of claim, and many churches haven’t asked whether their current coverage addresses it at all, or whether their giving platform vendor’s security practices have ever been reviewed.
Fix it: Ask your agent directly whether your policy addresses cyber liability and data breach response, since it’s often not included by default in a standard package policy. Separately, ask your online giving and database vendors what security certifications they carry — most churches have never asked.
None of this requires an overhaul. It requires one afternoon a year where someone walks through these five questions with fresh eyes, ideally alongside whoever manages your insurance relationship. The churches that avoid painful surprises aren’t the ones with the most coverage — they’re the ones whose coverage still matches what the church is actually doing.
Matt Mattingly is a licensed Property and Casualty insurance broker who has spent 20 years in the industry, the last 15-plus of them focused specifically on the risks facing religious institutions. As Vice President of Property and Casualty at Leading Risk Service Co., he works directly with churches and denominational bodies to close the gap between what their policies say and what their ministries actually do. Mattingly holds the Associate in Risk Management (ARM) designation and is a graduate of Binghamton University.
