The First 48 Hours After an Incident: An Australian Claims Guide

What you do in the two days after a fire, theft, accident or cyber event often shapes how the claim is paid. A Australian guide to the first 48 hours.

Whether it is a shed fire, a stolen ute, a vehicle accident, a workplace injury or a cyber incident, the first two days after an event tend to set the tone for the entire claim. By the time the loss adjuster arrives or the insurer's claims team picks up the file, the scene has usually been altered, witnesses have moved on, and the version of events that gets recorded is the version that was written down – or not written down – in those early hours.

The good news is that a small amount of structured action in the first 48 hours protects the claim, the people involved and the business. The following is the sequence we walk clients through.

Hour zero to two: make people and the scene safe

Before anything else, attend to safety. Get people clear of fire, livestock, machinery, flood water or any continuing hazard. Call 000 where life, property or the environment is at risk. For workplace injuries, follow your first-aid procedures and notify the relevant regulator if the incident is notifiable under work health and safety law.

Once the immediate danger is contained, secure the site. Lock gates, tape off damaged areas, isolate power where safe to do so, and prevent further loss – a tarp over a damaged roof, a guard on a broken window, livestock moved to a safe paddock. Insurers expect reasonable steps to mitigate further loss, and most policies require it.

Hour two to twelve: notify the right people

Once safety is in hand, notification begins. For a fire or major property loss, that means the fire service report number where one was issued. For theft, malicious damage, or any criminal act, that means a police event number – most insurers require one before a theft claim can be processed. For a vehicle accident, exchange details and obtain a police report number where one is available.

“Insurers do not pay what happened. They pay what can be proven happened. The first 48 hours is where that proof is built.”

Then call us. Not the insurer's 1800 number – us. A short phone call at this stage lets the broker triage the event, identify which policy or policies respond, flag any time-sensitive notification obligations, and start the formal claim process on the right footing. For cyber incidents in particular, the broker can engage the policy's incident response panel within hours, which is often what the wording requires.

Hour twelve to twenty-four: preserve evidence

Before anything is cleaned up, moved or repaired, document the scene. Photograph and video the damage from multiple angles, including wide shots that establish context and close-ups that show specific damage. Capture serial numbers, asset tags, registration plates and any markings that identify what was lost or damaged. Keep damaged items where they are unless safety or further loss requires moving them – adjusters often want to inspect the item.

Collect witness details while memories are fresh. Names, phone numbers, and a short written note of what each person saw. For workplace incidents, secure CCTV footage before it is overwritten on the standard retention cycle, which on many systems is as short as seven days.

Day one to two: build the paper trail

By the end of the first day, the claim file should be starting to take shape. A short written timeline of what happened, when, and who was involved. Copies of any reports – police, fire, ambulance, regulator. Photographs and videos stored somewhere safe and backed up. Invoices, valuations or schedules that establish what was lost. For business interruption, a note of the date and time operations were affected, and what is being done to resume trading.

Track every dollar spent in response to the loss. Emergency repairs, temporary accommodation, hire equipment, additional labour, freight. Many of these costs are recoverable under the policy as costs incurred to mitigate further loss or as additional cost of working, but only where they are documented.

Mistakes that reduce claims

A handful of avoidable mistakes turn up repeatedly. Cleaning up or repairing before the insurer has inspected the damage. Disposing of damaged stock or equipment without photographs or an itemised list. Admitting fault at the scene of a motor accident or a liability incident. Speaking to the other party's insurer or lawyer without first speaking to your own broker. Delaying notification because the loss looks small – and discovering later that it is not.

For cyber events specifically, two further mistakes are common. Paying a ransom or engaging an unapproved incident response provider before the insurer is notified, which can void cover. And restoring systems from backup before forensic evidence is captured, which can frustrate both the claim and any subsequent regulatory investigation.

When to call the broker, not the insurer

The default for any incident likely to result in a claim is to call the broker first. The broker can lodge the notification, choose the right policy under which to lodge it, and ensure the wording is read in the client's favour from the outset. Calling the insurer's general claims line direct often results in the claim being routed by topic rather than by wording, and small details in the first notification can be difficult to correct later.