Playbook, insurance broker
The assurance form, and the certificate that arrives with it
A client's procurement team sends two things at once and they get treated as one: a questionnaire about how the broker handles data, and a request for evidence of the broker's own professional indemnity cover. The first is a controlled document that somebody at the firm signs. The second is a certificate obtained from an insurer. An assistant that answers either freehand has produced a statement the firm will be held to.
Why this is not the general answer
The handling pattern for security questionnaires holds across every trade. What follows is the part that does not.
- The broker holds an unusually rich file on a commercial client: the risk detail, the claims experience, and on some schemes the personal data of that client's own staff, so these questions arrive with more weight than a general supplier form carries.
- The request nearly always includes evidence of the broker's own cover, which is not a security answer at all but a document to be obtained, and treating the two as one request delays both.
- Answers here become contractual, since a completed assurance form is attached to an agreement and relied on, which is why no sentence in one may be composed in a chat window.
- The sender is not the client contact the firm deals with day to day, so the reply has to be useful to somebody who has never spoken to the broker and is working down a checklist.
How it arrives
- who do i send our supplier security questionnaire to
- can you send evidence of your professional indemnity cover
- where is your data processing information
- do you hold our employees personal data
- how long do you take to return a completed questionnaire
- do you have anything already written we can review
What has to be indexed for this to work
| A published summary of how client data is handled | What you hold, where it goes, who has access to it, and how long it is kept. Most questionnaires are answered largely out of a document like this, and having one lets the assistant hand over something real instead of a promise to reply. |
|---|---|
| Who owns these and how long they take | The named function, the route in, and a realistic turnaround. Procurement teams work to a date, and a firm that says who and when is already ahead of one that says somebody will be in touch. |
| The evidence pack you can actually issue | Your own cover evidence, any certification you genuinely hold, and your standard terms. List only what exists, because a page implying an accreditation the firm does not have is a larger problem than the questionnaire was. |
| Anything about employee or scheme data | Where a client's staff data sits on a group scheme, who processes it, and on what terms. This is the question that separates a broker's assurance answers from a general supplier's, and it should never be improvised. |
The reply
These go to a person here rather than through this chat, because a completed questionnaire ends up attached to a contract and relied on. What I can do now is point you at what we publish about how client data is handled [1], and note that a request for evidence of our own cover is a separate thing we obtain rather than an answer we write [2]. If you leave your name, an email and the client you are acting for, it goes to the team who complete these, and the page above gives a sense of how long they take [3].
It refuses in the first clause and gives the reason, which a procurement reader accepts at once because it is the reason their own firm would give. It splits the cover evidence out from the questionnaire, since the two travel on different tracks and bundling them delays the faster one. And it hands over something readable in the meantime rather than only a promise of contact.
Where it stops
The trigger. The visitor asks a specific control question, describes a form to be completed, or asks for evidence of the firm's own cover.
I am not going to answer control questions here, because the answers end up inside a contract. Leave me your name, an email and who you are acting for, and it goes to the person here who completes these.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never answer a specific control question, because the answer is relied on contractually and the assistant cannot see how the firm actually operates.
- Never claim a certification, standard or accreditation, since one wrong word there is a misrepresentation inside a procurement process.
- Never describe where a client's data sits or who processes it beyond what the firm has already published.
- Never state the limit or the expiry of the firm's own cover, because that is read off a certificate the assistant has not seen.
Questions
- Can it fill in the easy parts of a form?
- No, and the easy parts are where it would do the damage. A form is signed as a whole, so a plausible sentence at question four is as binding as a careful one at question forty.
- Is publishing a data summary worth the effort?
- It is one of the few documents that pays twice: it shortens every questionnaire your team completes, and it gives the assistant something exact to hand to anybody who asks before a form has even arrived.
- Procurement teams want our cover evidence immediately. Can it help?
- It can say that this is a document you obtain, and route the request to the right place the same day. It cannot state a limit or an expiry, because it has not seen the certificate and an invented figure would be relied on.
Keep reading
- Everything for a insurance brokerProduct information is safe ground. A personal recommendation is regulated, and no assistant may confirm whether a loss is covered.
- Handling security questionnaires in generalA buyer-side question arriving in the wrong place. Answer only what you publish, and never let an assistant improvise a claim you then own.
- A loss, a chat window, and the first hourA customer reporting theft or damage needs the claims route in one reply, plus what not to do in the first hour. Nothing about cover.
- Three sets of hours, and only one of them is the broker'sThe office opens at nine, but nothing goes on risk until an insurer is open, and the claims line keeps hours the broker does not set.
- What can be adjusted, and the request that is something elseA wording in large print is an adjustment. Letting a relative deal with the policy is a change of authority, and not the same request.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.