Bounded piece of work · before your renewal
Do not find out at claim time that an answer was wrong
Cyber-insurance applications are usually completed from memory, under time pressure, by somebody who will not be the person asked to prove the answers later. We check each answer against the evidence before the form goes in.
Why this is worth doing
An insurance application is a set of statements about your organisation. If one of them turns out to be materially wrong, the consequence is not a smaller settlement. Under the Insurance Act 2015 you owe your insurer a duty of fair presentation of the risk. A qualifying breach of it can cost you the policy from inception, and where the breach was deliberate or reckless the insurer may avoid the contract, refuse every claim and keep the premium.
Two things about that are worth knowing, because most people assume the opposite.
It does not have to be deliberate. An innocent error voids the contract just as an intentional one does. The insurer does not have to prove anyone lied.
It does not have to relate to the loss. The statutory test is whether the circumstance would have influenced the judgement of a prudent insurer in deciding whether to take the risk and on what terms — not whether it caused the incident you are claiming for. Where the breach was neither deliberate nor reckless the remedy is proportionate: if the true facts would have carried a higher premium, your claim is cut by the same proportion.
So the risk is not dishonesty. It is a director writing “yes, we have multi-factor authentication” in good faith, because that is what they were told, when it is switched on for email and not for the remote access the attacker actually used.
Why us, and not your broker or your IT provider
Your broker arranges the cover and your IT provider runs the systems. Neither is in a position to confirm independently that every answer on the proposal form can be supported by evidence. That is the one job we do, and it makes your broker’s job easier, not harder.
We have no stake in the answer. We do not place insurance, we do not sell the remediation, and we are not the people who built the controls being described.
What we actually do
Every question area on your insurer's application, checked against what can actually be produced.
- Fifteen question areas, covering what UK insurers ask
- For each: what is being declared, and what evidence would support it
- A verdict recorded from evidence seen and dated during the review — supported, partly supported, not supported, or not tested
- The exceptions people miss: break-glass accounts, the supplier's admin login, the machine that cannot be patched
Three things, and they outlast the renewal.
- The completed review workbook, with a verdict against every declaration
- An indexed evidence folder — the artefacts themselves, named and dated
- A one-page management sign-off for whoever signs the application
- A short list of what to do before submission, ranked by what would matter most at claim time
The sign-off is the point
The document that matters is one page. It records what was reviewed, what the evidence showed, what was not tested, and how many declarations cannot currently be evidenced. Then a named person signs to confirm that the answers going to the insurer match that position, including every exception.
That signature is the whole value. It turns a form somebody completed on a Thursday afternoon into a decision the organisation took deliberately, with a record of what it knew when it took it.
What we do not do
We tell you what is unsupported. We do not fix it.
We do not sell remediation and we will not recommend a vendor to carry it out. We do not place insurance, and this is not legal advice — your broker places the risk and your lawyer advises on the contract. We give no assurance on anything we were not shown, and everything untested is recorded as untested, in the workbook and on the sign-off.
This is an assessment, so we will not then advise you on the gaps we found. We say so before you book.
When to book it
Thirty to sixty days before renewal. That is not a scheduling preference — it is the point of the exercise. If an answer turns out to be unsupported, you need enough time to choose between making it true and answering accurately at a different price. Two weeks out, you have no choice left.
For brokers
We work alongside brokers, not against them. We do not place cover, recommend insurers or comment on terms. With your client’s consent you receive the same evidence pack they do, in time for submission, so the proposal form goes to market with answers that will hold up at claim time.
Refer a client for a renewal review
What it costs
One application, one insurer, one renewal. Fixed price, agreed before we start.
£795 + VAT
Additional insurers' applications in the same renewal cycle, £325 + VAT each — the evidence work is already done.
If you would rather work through it in your own time, the same fifteen question areas are in our companion product — what each question is really asking, where it usually goes wrong, and what a defensible answer needs.
£95 + VAT
The companion is the same material. This review is us verifying it.
If part of your group sits in Jersey, Guernsey or the Isle of Man, that entity answers to its own data protection authority on its own clock, and UK insurers routinely ask about it. What the islands add to a renewal.
What actually happens, and when
First conversation
No charge and no obligation. We establish your renewal date and whether this is worth doing at all. If your renewal is too close for the findings to be useful, we tell you that rather than sell it to you.
Within a week
We send a specific evidence request: the documents that answer your insurer’s actual questions, rather than a generic questionnaire.
Your effort
Allow four to eight hours of your team’s time, mostly locating documents, plus two short calls. This is the part organisations underestimate, so we would rather overstate it than surprise you.
Two to three weeks
We test each declaration against the evidence produced, and record a verdict from what was actually seen and dated. If something cannot be evidenced, it is recorded as unsupported rather than assumed.
Walkthrough
We take you through the findings. You receive the review workbook, the indexed evidence folder and the one-page management sign-off.
Afterwards
The findings are yours. We do not fix them, we do not recommend a vendor to fix them, and we take no referral fee from anyone who does. If you repeat the review at your next renewal, the evidence index makes it considerably faster.
Allow four to six weeks from first conversation to signed document, and book thirty to sixty days before your renewal date. Timings assume evidence arrives reasonably promptly; if it does not, we will tell you what is holding it up rather than quietly slipping.
There is no charge for the first conversation and no obligation at the end of it. If your renewal is too close for this to be useful, we will tell you that rather than sell it to you.