This article presents an overview of flood risk and outlines how to assess whether your organization has sufficient coverage to provide protection if your building(s) and the contents are damaged in a flood. It also discusses the value of having plans in place for business continuity and disaster recovery in the event of a flood (or any other major disruptive event) affecting your operations.

Flooding can happen anywhere

Most flood insurance claims come from what the National Flood Insurance Program calls Special Flood Hazard Areas, which have a high risk of flooding. However, more than 40 percent of claims in recent years have come from areas that have a moderate-to-low risk of flooding.

In fact, 99 percent of all U.S. counties have experienced a flood event since 1998, according to the Federal Emergency Management Agency (FEMA).

Recent experience

Hurricanes and tropical storms can lead to coastal flooding. During the 2024 Atlantic hurricane season there were 18 named storms, according to the National Oceanic and Atmospheric Administration (NOAA). Three led to major flood damage:

• In July 2024, Hurricane Beryl caused significant storm-surge flooding in Louisiana and Texas.
• In September 2024, Hurricane Helene caused catastrophic flooding across the southern Appalachians and storm surge-flooding along Florida’s west coast.
• A few weeks later, in October 2024, Hurricane Milton caused record-breaking rainfall of 10-15 inches in Florida, resulting in localized flooding.

Moody’s RMS® estimates the losses related to these three hurricanes will likely range between $35 billion and $55 billion.

Heavy rains can also trigger flash flooding and levee or dam breaks. In January 2024 parts of San Diego were flooded following heavy rain. In June 2024, several states in the Midwest — Iowa, Minnesota and North Dakota — experienced catastrophic flooding after record rainfall of more than a foot in some areas. NOAA estimated that the losses totaled more than $1 billion. In February 2025, Kentucky experienced floods after several days of heavy rain.

Melting snow is another source of floods. In December 2024, some states in the Northeast — Connecticut, Massachusetts, New Hampshire, New York and Vermont — experienced heavy snowfall followed by rapid melting that led to flash-flood warnings in some areas.

There’s also a higher risk of flash flooding and mudflows in the aftermath of wildfires. Fortunately, the heavy rain that fell in the Los Angeles area after the wildfires began, did not trigger flash flooding or mudflows.

Rising flood risk

The nonprofit First Street Foundation and global engineering firm Arup looked at the risk of flood damage to 3.6 million retail, office and multi-unit residential properties across the U.S.

A key finding of their research, “The 4th National Risk Assessment: Climbing Commercial Closures,” was that U.S. businesses could face $16.9 billion in structural damage by 2052, as noted next to the key in the following graph. That would be an increase of roughly 25 percent over 2022 estimated flood-related spending.

Percent Change in Flood Risk from 2022 to 2052 by Impact Category

Source: First Street Foundation, “The 4th National Risk Assessment: Climbing Commercial Closures” (December 13, 2021). Reprinted with permission.

NOAA publishes long-range flood risk estimates for three-month periods. NOAA is expected to issue its forecast for the 2025 Atlantic Hurricane season in May.

According to a 2022 article published in Nature Climate Change, flood risk is expected to rise in many counties over the coming decades, as the map below illustrates.

Percentage Increase in Estimated Flood Risk by County, 2020–2050

Source: Wing, O.E.J., Lehman, W., Bates, P.D. et al. Inequitable patterns of U.S. flood risk in the Anthropocene. Nat. Clim. Chang. 12, 156–162 (2022). https://www.nature.com/articles/s41558-021-01265-6

Even minor flooding can have a major impact

A flood doesn’t have to be severe to have a major impact on your organization.

Just a few inches of floodwater can cause tens of thousands of dollars in damage, according to FEMA.

Make sure you have adequate flood coverage

It’s a good idea to review your commercial insurance coverages to verify if you are adequately protected in the event of a flood.

Commercial insurance coverages do not always include flood protection. Even if they do, in geographic areas that have a high flood risk, it may be prudent to purchase a stand-alone flood policy. If you have a mortgage, the lender can require flood insurance depending on your flood zone.

Segal offers a complimentary policy review to assess the appropriateness of your current property and casualty coverage and flood coverage.

As part of our review, we will:

• Determine your flood risk based on FEMA’s flood maps, which are divided into several zones.
• Examine types of coverage you have for your building(s) and their contents, including business income/extra expense coverage. While building owners will need both building and contents coverage, tenants need to ensure they have adequate flood coverage to cover their contents, such as office equipment.
• Consider your claims data.
• Analyze your limit of liability and deductible to determine if your policy could benefit from improvements in the scope of coverage.
• If you have a flood policy in place, discuss with an insurance professional whether an excess flood policy would be more appropriate for your organization.

As a leading broker for plan sponsors for decades, we have the experience to give you insights into coverage gaps and options for closing them.

Be prepared for a flood — or other disruptive event — especially if your risk is high

The old saying “forewarned is forearmed” is particularly apt when considering flood risk and similar risks.

If your organization is affected by a flood, its ability to bounce back quickly increases if it already has plans in place to address disaster recovery and business continuity.

What to include in your disaster recovery plan

A disaster recovery plan is meant to help you protect, recover and restore critical IT systems and assets.

To ensure your plan has the essential elements, take these steps:

• Define what you consider to be a disaster that will trigger an organizational response.
• Document who the plan coordinator is (they may be a facilitator rather than the ultimate decision-maker), funding considerations and who has decision-making authority.
• Establish how a command center will be created, who will be on the identified recovery teams and how they will be invoked and notified.
• List each of your recovery teams and the individual checklists that they are responsible for, along with who will be on which teams (e.g., emergency management team, administration team, operations team, data center team and data security team).
• Identify the appropriate team actions and approval process to initiate recovery of your operations (e.g., make repairs to your facilities systems and replace damaged IT hardware and communications technology).
• Develop template messages, timing guidelines and communications priorities for how you will communicate with your people, clients, vendors and insurers. Note how often you will communicate with the constituencies, as well.
• Set up and document protocols for submitting insurance claims.
• Agree upon criteria to determine when to deactivate the disaster recovery plan.

The Occupational Safety and Health Administration’s website has helpful information on flood preparedness and response, including common hazards and how to protect your recovery team.

What to include in a business continuity plan

A business continuity plan ensures employees and assets are able to perform essential business functions safely and with minimal downtime.

As part of your organization’s business continuity plan, be sure to:

• Do a simple risk assessment, listing all the natural, man-made and technology-specific risks that could beset you, and their likelihood.
• Perform a business impact analysis (BIA), which is a process to identify and evaluate potential effects of disruptions on critical systems, based on your risk assessment. This includes identifying and documenting inputs, processes, outputs, dependencies and vulnerable structures and equipment (i.e., people or things, dependent processes and other variables, such as what happens during peak season versus any other time of year.) Note recovery time objectives — which is how long each critical system can be out of service — and recovery-point objectives — which are how much data and information you can risk losing, even completely and forever. Document these for each critical system identified.
• Select the team members who will oversee your organization’s response to a flood or other disaster and organize them into relevant teams based on your BIA and associated critical functions (e.g., executive, IT, specific business functions, general office and key third-party service providers).
• Create a plan for using backup resources, like generators and secure cloud storage of your data, and addressing alternative operational business procedures that may be necessary in the event of a disaster to continue delivering the critical systems identified in your BIA.
• Establish criteria for shutting down operations and evacuating the area. Remember, health and human safety is always the first priority.
• Outline how you will communicate with your people, clients, vendors and insurers. Note how often you will communicate with the constituencies, as well.

Need assistance creating these plans?

Segal’s Administration and Technology Consulting Practice helps organizations develop comprehensive disaster recovery and business continuity plans that are tailored to their needs, so they can get back to business as soon as possible after a flood or other disaster.