Tools and providers
Part of Choosing insurance tools for 2027 after classifying the harm and mapping shared responsibility
Due diligence on an insurance technology vendor, from regulatory identity to exit
Run due diligence on a business insurance technology vendor serving England, covering legal identity, regulation, data, security, resilience and exit.
Use this checklist before a vendor receives policy, quotation, claim or customer information. The depth should reflect the harm caused by disclosure, alteration, outage or regulatory failure. A questionnaire is a starting point; significant claims need evidence and, where proportionate, independent assurance.
What to take away
- Due diligence depth should match the harm from disclosure, alteration, outage or regulatory failure.
- Public records may be incomplete for procurement, so treat them as sources to reconcile, not endorsements.
- Due diligence remains open throughout the relationship and should be repeated after major changes.
Corporate and regulatory identity
- Confirm the contracting entity, company number, address and ownership.
- Review current filings and insolvency information through Companies House.
- Identify every insurer, intermediary, sub-contractor and hosting provider in scope.
- Check relevant regulated entities on the FCA Register.
- Obtain perimeter advice where functions may amount to insurance distribution or financial promotion.
- Record insurance, financial position and business-continuity evidence relevant to the contract.
Public records may be incomplete for the procurement decision. Treat them as sources to reconcile, not official endorsements.
Corporate and regulatory identity checks
- Confirm contracting entity, company number, address, ownership
- Review filings and insolvency via Companies House
- Identify insurers, intermediaries, sub-contractors, hosting providers
- Check regulated entities on the FCA Register
- Obtain perimeter advice on distribution and promotion
- Record insurance, financial and continuity evidence
Product and service fit
- Map each promised function to a written specification and supported version.
- Test the highest-risk workflows with redacted or synthetic data.
- Record accessibility, browser, device, integration and support limitations.
- Confirm release, maintenance and end-of-support arrangements.
- Identify manual workarounds and accountable service contacts.
- Prevent unapproved artificial-intelligence or analytics reuse of customer records.
Ask the supplier to demonstrate a correction, failed handoff, staff departure and complete record export, not only the successful route.
Data protection
- Decide controller, joint-controller and processor roles from actual purposes.
- List personal-data fields, sources, recipients, locations and the maximum retention period, which the purpose and any statutory duty determine.
- Check lawful bases, transparency, rights assistance and sensitive-data conditions.
- Put required processor terms and documented instructions in the contract.
- Review sub-processors and international-transfer arrangements.
- Test return, deletion and backup treatment after termination.
The ICO's controller and processor guidance explains that contractual labels do not override who decides purposes and essential means.
Security and resilience
- Classify confidentiality, integrity and availability needs.
- Assess identity, privileged access, encryption and customer separation.
- Review secure development, vulnerability handling and penetration-test scope.
- Require useful customer logs and a stated maximum incident-notification window.
- Examine backup, restoration, recovery targets and tested results.
- Map fourth-party dependencies and concentration risk.
- Agree service levels, escalation and communications during failure.
Use the NCSC's cloud security principles to structure evidence for cloud or software-as-a-service. The provider's response must cover the actual service and configuration, not its company in general.
Ask for named assurance: ISO/IEC 27001 certification, a SOC 2 report or Cyber Essentials certification, each with its scope, audit date and any exceptions.
An example clause is: "The supplier must notify the customer of a confirmed or suspected security incident within 24 hours of detection, and provide a root-cause report within 10 working days." A processor must tell the controller without undue delay, and a reportable personal data breach must reach the ICO within 72 hours of awareness.
For regulated firms, the FCA's outsourcing and operational resilience page explains that third-party use does not remove regulatory responsibility and points to current requirements. Compliance specialists should establish notification and oversight duties.
Contract, monitoring and exit
- Define service, price, renewal, indexation and change controls.
- Include confidentiality, security, audit, incident and cooperation terms.
- Allocate intellectual property and data rights.
- Establish complaint, liability, insurance and dispute provisions.
- Require usable exports, transition help and deletion evidence.
- Set key indicators, evidence reviews and stop conditions.
End with a recorded risk decision, actions, owners and deadlines. Due diligence remains open throughout the relationship: repeat it after ownership changes, major incidents, new sub-processors, material feature changes or evidence expiry.
Create a remediation table for every conditional pass. State the gap, temporary control, evidence required, accountable person and final date. A sales promise is not closure; the agreed change must be delivered and retested. If a high-impact condition misses its deadline, suspend the affected data flow or rollout under the pre-approved stop rule.
Worked example. A claims portal reads records but cannot return them in a usable format.
The conditional pass records the gap, keeps a weekly manual extract as the temporary control, requires a documented export as evidence, names the operations lead as accountable and sets an illustrative 30-day final date. Under the stop rule, if the export is not delivered and retested by that date, no new claims are loaded into the portal.
Share material findings with the operational owner, not only procurement. People running renewals or claims need to know the service limits, fallback and escalation route before an incident exposes them.
Common questions
How should the depth of due diligence be decided?
The depth should reflect the harm caused by disclosure, alteration, outage or regulatory failure. This ensures the effort matches the risk and that critical claims are properly verified.
What should be done if a high-impact condition misses its deadline?
Suspend the affected data flow or rollout under the pre-approved stop rule. A sales promise is not closure; the agreed change must be delivered and retested. This prevents ongoing risk while the condition remains unresolved.
Who should receive material findings from due diligence?
The operational owner as well as procurement.
