AIG
Supplier data-governance audit
Nationwide supplier audit
Read the AIG case studyFinancial Services & Insurance
Governance and supplier assurance for financial services and insurance
Financial-services firms rely on suppliers, platforms and outsourced services that handle customer data on their behalf. We help insurers and financial-services businesses evidence how that data is governed, and build data protection into new platforms from the start.
View Relevant Case Studies Not sure where to start? Tell us what you need to decide or resolve.
Relevant experience
Published work in this sector
Greengage
Retained DPO service with wider specialist support
Data protection by design for a digital merchant bank in development
Read the Greengage case study
Habro
GDPR gap analysis, compliance report and implementation support
GDPR gap analysis through to implementation
Read the Habro Property Management case study
Client voices
What clients in this sector say
“The audit not only identified areas of improvement but also showcased our dedication to transparency and integrity.”
Kojo KwartengHead of Client Services EMEA, AIG“The well-measured advice, support, and training that IG-Smart Ltd's subject matter experts provide […] enables us to ensure that we take the proactive steps necessary to embed stringent measures and robust controls into the fabric of our businesses and solutions.”
Sean KiernanCEO, Greengage“We are a small business and therefore required a bespoke approach, which I feel IG Smart provided to the highest level.”
Mark AveryCEO, Habro Property Management
What is at stake
What makes governance difficult here
Data held by third parties
Records and customer data held by suppliers remain the firm's responsibility. Assurance needs to come from evidence, not contract wording alone.
New platforms, built correctly
New products and digital platforms are easier to govern when data protection is designed in rather than added before launch.
Security and resilience scrutiny
Boards, customers and partners expect security and resilience to be tested and reported clearly.
How we help
Start with the requirement, not the service catalogue
- Cyber Governance & Supplier AssuranceFor independent supplier audits and cyber assurance where customer data sits with third parties.
- Information Governance ConsultancyFor records, retention and data-governance controls that hold up to audit.
- Outsourced & Fractional DPOFor firms that need DPO capability and data protection by design while the business is being built.
Requirements organisations commonly encounter
Depending on the type of firm, its activities and regulatory perimeter, relevant requirements and supervisory expectations may include operational resilience, outsourcing and third-party risk management requirements set by the FCA and/or PRA. Other requirements may also apply:
- UK GDPR and the Data Protection Act 2018
- FCA and/or PRA operational resilience, outsourcing and third-party risk management requirements, for firms in scope
- ISO/IEC 27001, where buyers or partners require it
For firms in scope, these can include matters such as:
- Important business services
- Impact tolerances
- Mapping and testing
- Third-party dependencies
- Outsourcing governance
- Due diligence
- Ongoing oversight
- Business continuity and exit planning
Working with us
Ways organisations in this sector work with us
Defined engagements
Assessment, audit, readiness, remediation, assurance and defined programmes.
Managed & retained capability
Ongoing specialist governance and assurance where continuity matters.
Discuss your requirement with a senior practitioner
Tell us what you need to decide or resolve, or share a defined requirement for review.