Guide for brokers and distributors
Audit-trail checklist for insurance brokers
Twelve questions to put to any system that holds the record of what you quoted: your CRM, your broker software, a spreadsheet, or us. They are written for a broker in Belgium, where the FSMA supervises the conduct rules of the Insurance Distribution Directive, but nothing in them is Belgian-specific. Our own answer follows each one, including where it is no.
1–3 · What is in the record
Does it hold what you would be asked for?
| Question | Why it matters | RiskRouter |
|---|---|---|
| 1. Does each entry say exactly what was proposed? | “Travel cover, about €6” does not show the proposal fitted the customer’s needs. Every option, on or off, does. | Yes. The vertical, every component’s on or off state, and the premium in integer cents. |
| 2. Does it record which price rules applied? | A price changes. Without the version, a two-year-old quote cannot be explained. | Yes. Every entry carries the rating-matrix version that priced it. |
| 3. Does it record the demands and needs assessment? | It is the heart of IDD Article 20. See what Article 20 asks. | No. We hold no customer information, so that assessment stays in your own system. |
4–7 · Integrity
Could the record have been changed?
| Question | Why it matters | RiskRouter |
|---|---|---|
| 4. Can anyone edit or delete an entry, including an administrator? | If an administrator can, the record is only as good as that administrator’s word. | No one can. The database refuses edits and deletions for every role, including the administrative one. |
| 5. If an entry were changed, would anyone be able to tell? | Preventing edits is a policy. Detecting them is evidence. | Yes. Entries are hash-chained: changing one breaks every entry after it. Try it. |
| 6. Can the vendor deny a checkpoint it gave you? | A checkpoint the vendor can disown protects the vendor, not you. | No. Every attestation of the chain’s head is signed; one you saved is ours whether we like it or not. |
| 7. Is the time of each entry independently proven? | Without it, “when” is still the vendor’s word. | Bounded. Our 13 September 2026 head is timestamped in Bitcoin (blocks 967830 and later, via three OpenTimestamps calendars), so every entry it covers existed before that block. The exact time between an entry and the next anchored head is still our word; heads are anchored weekly. |
8–10 · Independence
Can you check it without the vendor?
| Question | Why it matters | RiskRouter |
|---|---|---|
| 8. Can you export your own entries at any time? | Evidence you can only see inside the vendor’s screen is evidence the vendor controls. | Yes, one authenticated request, no one to ask. |
| 9. Can you verify the export without the vendor’s software? | If the checker is theirs, the check is theirs. | Yes. Two dependency-free scripts in a separate public repository, or the checker on the verify page, which runs in your browser and sends nothing. |
| 10. Does the evidence survive the vendor going out of business? | The record has to outlive the contract. | Yes. An export you already hold verifies with no connection to us. |
11–12 · Honesty and data protection
Does it tell the truth when it fails, and keep personal data out?
| Question | Why it matters | RiskRouter |
|---|---|---|
| 11. When a write fails, does the system say so? | A system that shows “saved” for a record that does not exist is the failure an inspection is designed to find. | Yes. A quote whose entry was not written is reported as not recorded, never as a success. |
| 12. Is personal data kept out of the permanent record? | A record nobody can edit is also a record nobody can erase. Under the GDPR, personal data in it would be a problem you cannot fix later. | Yes. A quote entry has no field for a name, an email or an identifier. See data protection. |
One thing no system of this kind can prove: that every quote you gave was sent to it. A quote that was never recorded leaves no trace to find. A chain proves what is in it, not what is missing, and anyone who tells you otherwise is describing something else.
Scope
How to use this list
Use it on any supplier, including us, and ask for the evidence behind each answer rather than the answer. It is a practical checklist, not legal advice, and it does not say how long you must keep records: check that with your supervisor or your professional federation.