Choosing insurance tools for 2027 after classifying the harm and mapping shared responsibility

Direct answer: shortlist by workflow fit, then apply mandatory pass or fail gates on lawful operation, data use, security, export and resilience before scoring.

The right business insurance tool makes a defined process easier to operate and audit. It does not replace risk control, policy analysis, fair presentation, regulated advice or accountable judgement. For an organisation in England, selection should begin with the workflow and information at risk, then test suppliers on evidence, security, resilience, cost and exit.

This guide was checked on 5 September 2026 for 2027 planning. Product features, supplier status, FCA requirements and ICO guidance can change. Reopen every material source and supplier record before procurement or publication.

What to take away

Start selection with the workflow and information at risk, then test suppliers on evidence, security, resilience, cost and exit.
Selection sequenceworkflow, regulatory boundary, information model, harm, responsibility, evidence, scenario test, gates, cost, contract, exit.
Software that publishes general information faces a different regulatory question from journeys that arrange or recommend insurance.
Classify the harm from disclosure, corruption or unavailability before deciding how much supplier evidence is required.
A hosted supplier does not own every control, so customers must configure the service and test their own setup.
Set pass or fail gates for lawful operation, data use, security, export and resilience before scoring suppliers.

Decide which problem needs a tool

"Insurance management" can refer to several distinct tasks:

keeping policy wordings, schedules and endorsements;
maintaining an exposure and disclosure record;
preparing renewal submissions;
comparing quotations and policy fields;
arranging or advising on cover;
tracking claims and correspondence;
monitoring insurer, broker or supplier entities;
recording controls, incidents and continuity actions.

Write the start, finish, inputs, outputs, users and decision owner for one workflow. Include failure cases such as an inaccurate record, absent document, unavailable integration or staff departure. This prevents a visually impressive platform from winning a procurement it cannot support in practice.

Identify what the tool must never do. A document store should not silently convert an old proposal into a current fact. A comparison table should not call a narrow panel the whole market. A reminder should not decide that a business change is immaterial.

Mark regulatory boundaries before supplier contact

Software that publishes general information creates a different regulatory question from a journey that introduces, compares, arranges or recommends insurance. Automated wording does not make an activity unregulated.

Use the FCA's general insurance intermediary authorisation guide as an initial map, then obtain perimeter advice for the proposed function, entities and remuneration. Record who owns financial promotions, demands and needs, advice, customer money, complaints and claims.

FCA Handbook ICOBS 5 contains demands-and-needs and advised-sale provisions for insurance distributors. A supplier feature may support the process, but the accountable firm must determine the rules, approve the design and retain adequate evidence.

Define the information model

Start with sources rather than fields. A useful record distinguishes:

Information	Likely evidence	Control
Legal entity	Companies House record and corporate document	Verify identifier and effective date
Activity	Contract, website, operational confirmation	Owner approval and change trigger
Turnover or payroll	Finance and payroll reports	Period, method and reconciliation
Asset value	Asset register or valuation	Basis, date and reviewer
Policy term	Current wording, schedule and endorsement	Version lock and renewal relationship
Insurer answer	Dated correspondence	Preserve exact question and response
Claim action	Incident and communication record	Restricted access and chronology

Require history, authorship and approval rather than a single overwritten value. Blank, zero, not applicable and unknown must remain different states. Link documents without creating uncontrolled duplicates.

Classify the harm before reviewing security

Insurance records can reveal employee information, health details, claims, security measures, financial values and commercial contracts. Assess the impact if they are disclosed, corrupted or unavailable. The classification determines how much evidence is required from a supplier.

The NCSC's guide to choosing a cloud provider offers a lightweight approach for lower-risk services and a more complete principles-based assessment for sensitive or important workloads. It links the needed confidence to the consequences of data loss, alteration and outage.

For substantial risk, use the NCSC's fourteen cloud security principles. They cover data in transit, asset protection, customer separation, governance, operational and personnel security, development, supply chain, identity, external interfaces, administration, audit information and secure use.

Ask for evidence scoped to the contracted service. A supplier group may hold a certification that excludes the application, sub-processor or region being purchased. Record the auditor, date, exceptions and customer responsibilities.

Understand shared responsibility

A hosted supplier does not own every control. NCSC guidance on the cloud shared-responsibility model says customers remain responsible for ensuring the service meets their security needs, configuring what they use and deciding which data to place there.

Create a responsibility matrix for identity, authentication, permissions, encryption options, logs, backups, restoration, devices, integrations, incident response and deletion. Test the customer's configuration, not only the supplier's infrastructure claims.

Use individual accounts and least privilege. Protect privileged administration, review dormant users and require approval for bulk exports. Decide which alerts are visible to the customer and how long useful logs remain available.

Map data-protection roles and purposes

A company policyholder can still provide personal information about directors, staff, drivers, claimants and contacts. Trace each field through the platform, insurer, broker, analytics service and sub-processor.

The ICO's controller and processor guidance explains that roles follow decisions about purposes and means, not merely the contract label. Separate controller-to-controller disclosures from processing carried out under instruction.

For every purpose, document a lawful basis, transparency, recipients, retention, security and rights process. Special category and criminal-offence information need additional legal analysis. Prevent test environments, support teams and optional analytics from receiving live data without a justified and disclosed need.

The ICO currently marks some controller, processor and data-sharing material as under review following legislative change. Note the version relied upon and obtain current advice before signing.

Build a supplier evidence pack

Request records under eight headings:

contracting entity, ownership and financial position;
product specification, roadmap and support lifecycle;
regulatory role and authorised partners;
data purposes, locations, recipients and sub-processors;
security architecture, testing, incidents and assurance;
availability, backup, recovery and continuity evidence;
implementation, support and service levels;
full pricing, contract change, export and termination.

Verify the legal entity against Companies House information. Where insurance regulation is engaged, check the relevant entity on the FCA Register. Neither register endorses technical quality or commercial suitability.

Distinguish documents available to all customers from answers prepared for the sale. Independent assurance can increase confidence only within its scope. Ask how the supplier handled earlier material incidents and how disclosed weaknesses were corrected.

Compare suppliers on one scenario

create a record with an unknown value;
correct a fact after approval;
preserve two policy versions;
handle an unavailable integration;
remove a former employee's access;
locate claim contacts during supplier outage;
export documents, metadata and history;
show how eligible information is deleted.

Record clicks only when efficiency matters. More importantly, capture lost meaning, duplicate work, hidden defaults, inaccessible steps and reliance on supplier intervention. A successful guided demonstration is not evidence that ordinary users can operate the configured service.

Use mandatory gates before scoring

Set pass or fail requirements for lawful operation, data use, security, export and resilience. Only score suppliers that clear them. Suggested weighted areas include:

Area	Typical decision question
Functional fit	Can users complete the verified workflow without losing evidence?
Regulatory fit	Are activities and responsibilities approved and visible?
Data protection	Are purposes, roles, rights, sharing and retention defensible?
Security	Does scoped evidence meet the impact classification?
Resilience	Can the organisation operate and recover within its tolerance?
Accessibility	Can intended users complete critical tasks?
Cost	What is the comparable whole-life cash and staff cost?
Exit	Can records and operations move without lock-in or loss?

Document why each weight matches the business consequence. Do not allow a high usability mark to offset an unacceptable data purpose or absent export.

Shortlist paid tools and official free services

Shortlist by workflow first. Generic suites, broker platforms, specialised registers and official free services solve different jobs. The table gives a short ranked recommendation for a small-business workflow.

Supplier type

Store policies, schedules and renewal documents: Generic cloud document and workflow suite
Track renewal tasks, contacts and submissions: CRM or workflow platform
Quote, arrange or recommend cover: Regulated broker platform or online broker
Record risks, incidents and continuity actions: Risk, incident or GRC platform
Check cyber and data-protection readiness: Official free assessment
Verify entities and regulated status: Official public registers

Named example

Store policies, schedules and renewal documents: Microsoft 365, Google Workspace
Track renewal tasks, contacts and submissions: Salesforce, HubSpot
Quote, arrange or recommend cover: Acturis, Applied Systems, Simply Business
Record risks, incidents and continuity actions: Riskonnect, Xactium
Check cyber and data-protection readiness: NCSC Cyber Action Toolkit, ICO data-protection self-assessment
Verify entities and regulated status: FCA Register, Companies House

Differentiator

Store policies, schedules and renewal documents: Microsoft 365 adds Teams and Office apps for small teams; Google Workspace offers browser-first collaboration; neither has an insurance policy model
Track renewal tasks, contacts and submissions: Salesforce suits complex pipelines and custom objects; HubSpot has a lower-cost small-business CRM tier; neither arranges insurance
Quote, arrange or recommend cover: Acturis connects brokers to insurer e-trade schemes; Applied Systems targets larger brokerages with accounting and servicing modules; Simply Business is a direct online broker for micro and small businesses
Record risks, incidents and continuity actions: Riskonnect covers risk and incident registers for larger firms; Xactium focuses on risk and regulatory workflows; pricing is quoted
Check cyber and data-protection readiness: Both are free and official; the NCSC tool sequences cyber actions, while the ICO assessment covers data-protection checks
Verify entities and regulated status: The FCA Register confirms regulated status; Companies House confirms corporate details; neither endorses technical quality

Pricing model

Store policies, schedules and renewal documents: Per user per month, public list prices
Track renewal tasks, contacts and submissions: Per user per month, public list prices
Quote, arrange or recommend cover: Quoted per module and user, or broker commission
Record risks, incidents and continuity actions: Quoted per user or module, not public list
Check cyber and data-protection readiness: Free
Verify entities and regulated status: Free

Several public services support inputs without becoming insurance-selection engines:

the FCA Register for regulated-entity records;
Companies House's free search and Follow features for corporate details and filed changes;
the HSE risk assessment template and examples for workplace-control records;
the NCSC Cyber Action Toolkit for sequenced cyber actions aimed at small businesses and sole traders;
the ICO data-protection self-assessment for relevant controller, processor, security, marketing, records and sharing checks.

Their inclusion here is based on distinct planning utility, official provenance and free access at the check date. Each has scope limits. Completion does not prove that a policy is suitable, a supplier is safe or every legal requirement is satisfied.

Calculate the whole-life cost

Use a consistent term and workload. Include licences, user tiers, storage, transactions, setup, data cleaning, migration, configuration, integrations, testing, training, support, security review, price changes, contract management and exit.

Typical pricing models vary. Generic document and workflow suites often use public per-user monthly list prices. Insurance-specific broker platforms rarely publish list prices; they usually quote per module, user tier and policy volume. Official registers and the NCSC and ICO assessments are free.

Worked whole-life example, illustrative only: five users, 2,000 policies, one insurer integration, three-year term.

Cost line	Assumption	Three-year total
Licence	GBP 2,000 per year	GBP 6,000
Implementation and configuration	GBP 3,000 one off	GBP 3,000
Integration	GBP 1,500 one off	GBP 1,500
Data cleaning and migration	80 internal hours at GBP 40 per hour	GBP 3,200
Training	20 internal hours at GBP 40 per hour	GBP 800
Security review	GBP 1,200 per year	GBP 3,600
Support and updates	Included in licence	GBP 0
Exit and export	GBP 1,000 one off	GBP 1,000
Total		GBP 19,100

Replace every figure with supplier quotes and your own payroll rates.

Estimate internal hours by role and state the assumption. Separate unavoidable transformation work from supplier-specific work. A low subscription can be expensive if staff must rebuild policy history or manually reconcile every insurer response.

Model lower, expected and high-volume cases. Identify costs paid upfront, annually, per transaction and on termination. Check tax treatment with the appropriate adviser.

Contract for operation and exit

The contract should describe the service, data roles, security responsibilities, support, availability, incident notice, audit, sub-processors, change, ownership, confidentiality, liability, insurance, pricing, renewal, termination, assistance, export and deletion.

Service credits do not restore an unavailable claim file. Combine contractual remedies with technical and operational fallback. Require tested exports in documented formats and enough metadata to preserve relationships and audit history.

For FCA-regulated organisations, the regulator's outsourcing and operational resilience page explains third-party expectations and notes new 2027 operational-incident and third-party reporting rules. Qualified compliance review should determine materiality, notification, oversight and applicable dates.

Implement in controlled stages

Begin with one business unit, policy type or non-critical workflow. Reconcile migrated totals and documents against the source. Preserve a read-only fallback until acceptance and restoration tests pass.

Configure roles before inviting broad users. Train people to locate source evidence, express uncertainty, approve changes and escalate insurance questions. Do not teach staff that a required field is automatically a fact.

Run end-to-end testing with operational users and people who have access needs. Exercise an outage, failed integration, incorrect migration, compromised account and urgent export. Assign every defect a consequence, owner and release decision.

Monitor the vendor and the outcome

After launch, measure missing evidence, correction rates, access exceptions, integration failures, document retrieval, support resolution and manual workarounds. Sample records from source fact to issued policy rather than relying solely on dashboard uptime.

Review supplier ownership, sub-processors, assurance, incidents, pricing and product changes on a schedule. Trigger an immediate reassessment after a breach, major outage, acquisition, material feature change, regulatory status issue or evidence expiry.

Maintain a tested exit pack. It should contain current exports, data dictionary, integration map, contract dates, deletion requirements, fallback instructions and accountable contacts.

Final decision checklist

Before award or renewal, confirm that:

the workflow and prohibited functions are written;
regulatory activities and owners have been approved;
data purposes, roles and recipients are mapped;
security evidence matches the actual service and risk;
migrations, corrections, outages and exports have been tested;
three-year costs use the same assumptions;
contract and service responsibilities align;
manual fallback and exit are viable;
unresolved issues have owners and deadlines;
volatile records will be reopened before commitment.

The strongest tool is not necessarily the broadest platform. It is the service that clears the organisation's mandatory controls, preserves the evidence behind each insurance decision and can be left without losing that evidence.

Before you act

Write the start, finish, inputs, outputs, users and decision owner for one workflow.
Identify what the tool must never do before procurement.
Mark regulatory boundaries and obtain perimeter advice before supplier contact.
Classify the harm to insurance records before reviewing supplier security.
Build a responsibility matrix covering identity, logs, backups, restoration and deletion.
Prepare a controlled demonstration pack using synthetic or properly redacted data.

Common questions

Why should a buyer classify the harm to data before reviewing supplier security?

Insurance records can reveal employee, health, claims, security, financial and contract information, and the impact classification sets the evidence required from a supplier.

What does the shared-responsibility model mean for a company using a hosted insurance tool?

A hosted supplier does not own every control; customers must configure the service, decide what data to place there and test their own setup.

How should a buyer compare competing insurance tools fairly?

Prepare a controlled demonstration pack using synthetic or properly redacted data. Give each supplier the same legal entities, policy types, documents, user roles and required outputs. Test routine and adverse cases, then capture lost meaning, duplicate work, hidden defaults and reliance on supplier intervention rather than clicks alone.