An audit-ready insurance record is not simply a folder containing the current policy schedule. It is a connected evidence trail showing what is insured, how the information supplied to the insurer was checked, which conditions apply and whether incidents, claims and risk improvements have been managed properly.
That distinction has become more important in 2026. The Regulator of Social Housing’s Regulatory Casework Review 2026 emphasises complete and accurate data, effective risk management and systems that track remedial actions. Its Sector Risk Profile 2025 also identifies insurance as a specific sector risk, stating that boards need current knowledge of cover and policy limits, supported by robust information about construction, insulation and reinstatement values.
The awkward part is rarely finding the policy document. It is proving that the information behind it remains accurate.
Key takeaways
- A policy schedule does not show how declared values, asset information and material risk disclosures were established.
- Every policy should be connected to the properties, entities, limits, conditions, claims and actions it covers.
- Renewal evidence should demonstrate a reasonable search for relevant information across the organisation.
- Insurance conditions and risk improvement requirements need named owners, deadlines and verified closure.
- Retention periods should reflect claims, legal, financial and data protection requirements rather than one blanket rule.
- Audit readiness should be tested throughout the policy year, not assembled shortly before renewal.
What does an audit-ready insurance record look like?
A record is audit-ready when someone outside the insurance team can follow it without relying on undocumented knowledge.
An auditor, broker, insurer or board member should be able to establish:
- Which legal entities, properties and activities are insured.
- Which policy version was in force on a particular date.
- How sums insured and declared values were calculated.
- What information was disclosed during placement or renewal.
- Which exclusions, endorsements, warranties and conditions apply.
- Whether incidents were notified within the required timescale.
- How claims, insurer surveys and risk improvement actions were closed.
The record should also explain discrepancies. A difference between an asset register and an insurance schedule is not automatically a failure, but an unexplained difference is difficult to defend.
Build one controlled insurance register
Start with a central insurance register that provides the route into the underlying evidence. This does not have to store every document in one location, but it should tell users where the authoritative version is held.
For each policy, record:
- the insurer, broker, policyholder and insured entities
- the policy number, cover period and renewal date
- the classes of cover and insured activities
- applicable properties, schemes or asset groups
- limits, sub-limits, deductibles and significant exclusions
- declared values, reinstatement values and valuation dates
- endorsements, warranties and policy conditions
- open claims, circumstances and potential notifications
- outstanding insurer surveys or risk improvement actions
- the owner of each record and its last review date
Use unique property and entity identifiers rather than names alone. Addresses, scheme names and company names change, while a controlled identifier gives you a more reliable link between the insurance register, asset system, finance records and claims data.
Version control matters as well. The register should distinguish clearly between a draft quotation, bound cover, a mid-term adjustment and an expired policy.
Make the renewal file show a reasonable search
Part 2 of the Insurance Act 2015 applies to non-consumer insurance contracts and requires the insured to make a fair presentation of the risk before entering into or varying a policy. This includes disclosing material circumstances that the organisation knows or ought to know following a reasonable search, or providing enough information to put a prudent insurer on notice that further enquiries are needed. (Legislation.gov.uk)
For a housing provider, that search may extend well beyond the insurance team. Relevant information can sit with assets, building safety, repairs, development, finance, governance, legal teams and contractors.
Create a documented renewal process that identifies:
- who was asked to provide information
- which systems and reports were reviewed
- the date on which each dataset was extracted
- how gaps, assumptions and conflicting records were resolved
- who approved the final submission
- which information changed after submission or during the policy year
The evidence pack may include property schedules, construction details, fire and structural information, claims history, void or unoccupied properties, planned works, acquisitions, disposals and current reinstatement valuations.
A completed questionnaire is useful. Evidence of how its answers were produced is stronger.
Connect insurance data to live property information
Insurance records become unreliable when they are maintained as a separate annual spreadsheet. Property acquisitions, disposals, changes in occupancy, major works and newly identified building risks can all affect the accuracy of cover.
Create defined change triggers so that the insurance record is reviewed when:
- a property is acquired, developed or disposed of
- a building becomes vacant or changes use
- significant construction information is corrected
- cladding, insulation or structural information changes
- major refurbishment or remediation begins
- a valuation identifies possible underinsurance
- a serious incident or emerging claim occurs
For higher-risk buildings in England, the statutory information requirements provide a useful benchmark. Government golden thread guidance, supported by the Higher-Risk Buildings (Keeping and Provision of Information etc.) Regulations 2024, requires specified building information to be digital, secure, available, usable and maintained as a reliable source of truth. Insurance documentation is not automatically part of the statutory golden thread, but it should draw from the same controlled building information where relevant.
Duplicating uncontrolled data into another spreadsheet only creates another place for it to become stale.
Track policy conditions and insurer actions through to closure
Policies can contain conditions relating to inspections, security, vacant buildings, fire protection, maintenance or the notification of changes. Insurer surveys may also result in risk improvement requirements with specific deadlines.
Treat these requirements as compliance actions. Each one should have:
- a clear description and source
- the affected properties or assets
- a responsible owner
- a target date
- supporting evidence
- an escalation route
- a closure decision and verification date
The part that often gets missed is verification. A contractor marking a job as complete does not necessarily show that the policy requirement has been satisfied. Closure evidence may need photographs, certificates, revised drawings, an inspection report or written acceptance from the insurer.
Keep a complete claims and incident timeline
A claims file should explain the event from first notification to final outcome. Record the incident date, when the organisation became aware, the policy notification date, decisions made, correspondence, evidence supplied, payments, recoveries and the reason for closure.
Potential claims and reportable circumstances also need control. Waiting until liability is certain may conflict with policy wording that requires notification when an organisation first becomes aware of an event or circumstance.
Link claims back to the affected property, contractor, compliance stream and policy condition. This makes it possible to identify repeated causes rather than treating each claim as an isolated transaction.
Apply a defensible retention schedule
There is no single retention period that is suitable for every insurance record. The period may depend on the policy wording, claim type, potential litigation, contractual requirements, financial records and whether a legal hold applies.
Set retention rules by record category, covering current and expired policies, renewal submissions, valuations, claims, incident evidence, correspondence and action records.
Where files contain residents’, employees’ or claimants’ personal information, the storage limitation and security principles under Article 5 of the UK GDPR and the Data Protection Act 2018 remain relevant. The Information Commissioner’s Office recommends documenting retention periods, the reason for them and the action taken when each period expires.
“Keep everything forever” is not a records-management strategy.
Test the evidence before an auditor does
Select a sample of policies, properties, claims and insurer actions each quarter. For every sample, ask whether you can produce the evidence without relying on the person who normally manages it.
A practical test should confirm that:
- the property appears on the correct current schedule
- its construction and occupancy information matches the asset record
- the declared value has a recorded source and review date
- applicable conditions can be identified
- open actions have owners and realistic deadlines
- claims can be traced from incident to settlement or closure
- changes are visible through an audit log or version history
Record the exceptions, correct the immediate issue and investigate the underlying cause. Repeated mismatches usually point to a weak handoff, an unclear system owner or an uncontrolled data extract.
A process that will stand up to scrutiny
Audit-ready insurance records are built through routine control rather than a final document-gathering exercise. Housing providers need one controlled register, reliable links to property data, documented renewal searches and clear ownership of conditions, claims and remedial actions.
The practical assurance test is straightforward: could your organisation explain what was insured, what the insurer was told, how the information was checked and what happened next?
When the answer is supported by current, traceable evidence, the insurance record is doing its job.
