Disclosure Quality and W&I Underwriting: Building a Data Room Insurers Can Price

1. Define the underwriting decision before opening the data room

The decision is whether the buyer can obtain binding W&I cover on terms that support the acquisition agreement, price and timetable. The board needs a controlled answer to five questions: which warranties are intended to be insured, what evidence supports them, which matters are known and therefore require another response, which exclusions remain, and whether the policy can be bound before the buyer relies on reduced seller recourse.

A data room is one input to that decision. Its purpose is to give authorised parties access to transaction evidence. Insurance underwriting requires more. The insurer needs to understand the business, the diligence performed, material findings, limitations, seller disclosure and the relationship between those materials and the proposed warranty package. The buyer should therefore govern the repository as an evidence system rather than a document warehouse.

The acquisition committee should approve an underwriting objective at process launch. The objective should identify the intended insured entities, policy limit, retention, minimum warranty set, governing law, target signing date and latest safe date for binding terms. It should also state the buyer's maximum acceptable uninsured exposure and the seller protections that cannot be released until cover is executable.

This decision framing prevents a common sequencing error. A team can upload thousands of files, complete diligence and negotiate the sale agreement while leaving the insurer to reconstruct the evidence at the end. That sequence creates avoidable exclusions and timetable pressure. An insurance-ready process begins with the warranty-to-evidence map and maintains it as the deal evolves.

2. Treat fair presentation as an evidence obligation

The UK Insurance Act 2015 requires a business insured to make a fair presentation of the risk before entering an insurance contract. The presentation must disclose every material circumstance the insured knows or ought to know, or provide enough information to put a prudent insurer on notice that it needs to make further enquiries. Disclosure must be reasonably clear and accessible. ^[1]

The statutory test matters in an acquisition because relevant information is distributed across people and systems. It can appear in the virtual data room, diligence reports, management presentations, financial models, disclosure schedules, Q&A exchanges, expert calls and draft transaction documents. The underwriting submission should reconcile those sources. A material tax risk described in diligence and omitted from management Q&A creates a control problem even if the underlying document appears somewhere in the repository.

The Act also identifies remedies for breach. Their application depends on circumstances including whether the breach was deliberate or reckless and what the insurer would have done with a compliant presentation. ^[1] Transaction teams should obtain legal advice on the policy's governing law and the applicable disclosure duty. Operationally, they should preserve a record of the searches performed, people consulted, materials delivered and questions answered.

The evidence obligation continues while terms are being negotiated. New information can emerge between the initial submission and policy inception. The buyer should define a bring-down process so that material developments, updated disclosure and final diligence conclusions reach the insurer before cover attaches.

3. Convert the data room into an underwriting architecture

The architecture begins with the warranties, not the folders. Each material warranty family should be connected to the underlying records, diligence scope, findings, disclosure, management confirmation and expected policy treatment. The connection allows the insurer to see both the evidence and the buyer's analysis.

The first layer is source evidence. It includes executed contracts, licences, intellectual-property records, employee data, tax filings, litigation material, financial records, policies, permits and operational reports. The second layer is the diligence work that tests those records. The third is seller disclosure against the warranties. The fourth is management confirmation of matters that require explanation or bring-down. The fifth is the insurer's treatment in the policy.

The architecture should be bidirectional. A reviewer should be able to start with a warranty and find the evidence. It should also be possible to start with a material finding and identify the warranty, disclosure, policy treatment and transaction response. This bidirectional design exposes gaps that folder-based navigation can conceal.

4. Build a warranty-to-evidence matrix

The matrix is the central control. It translates the acquisition agreement into an underwriting work programme and gives each material warranty an evidence owner. It should be maintained jointly by transaction counsel, the diligence leads, the broker and the buyer's deal team.

Warranty descriptions and policy outcomes are hypothetical and require transaction-specific legal and insurance review.

The matrix should distinguish evidence existence from evidence sufficiency. An uploaded contract may be unsigned, superseded, incomplete or unrelated to the entity being acquired. A tax return may prove filing without proving payment. A cyber policy may describe intended controls without demonstrating that they operate. The diligence column should state the test performed and the limitation that remains.

The expected policy-treatment column is provisional until wording is bound. It should use controlled statuses such as expected cover, underwriter query, condition, sublimit, specific exclusion, general exclusion or outside policy scope. The team should avoid terms such as clean or covered unless the supporting analysis and wording justify them.

5. Design a usable index and naming convention

An insurer has limited time to review the transaction. The repository should therefore identify the legal entity, subject, document type, effective date, version and status of each material item. Folder names alone rarely provide that precision. A controlled index can provide it without renaming every historical source file.

The index should record a unique document identifier, file path, title, entity, jurisdiction, period, confidentiality restriction, upload date, superseded status and owner. It should show whether a document was added after a diligence cut-off and whether the diligence team reviewed it. Material duplicates should be identified so that conflicting versions do not circulate.

Naming should support human review and machine-assisted search. Consistent dates, entity names and document types improve retrieval. Optical character recognition can make scanned files searchable, but the output requires validation where the text affects legal or financial analysis. Password-protected, corrupted or image-only files should enter an exception queue.

Access controls remain important. The buyer should respect confidentiality, competition-law clean-team restrictions, privilege, data-protection requirements and seller permissions. The insurance workstream should receive only the information it is authorised and permitted to use.

6. Separate missing evidence from adverse evidence

Missing evidence means the team cannot complete a planned test. Adverse evidence means the test identified a risk. These conditions require different responses. A missing register may require seller production, an alternative test or a scope limitation. An adverse litigation notice may require valuation, disclosure, a specific indemnity or exclusion.

Conflating the two creates weak underwriting. A diligence report that states no issue was identified can be misleading if the source population was incomplete. The report should state the population reviewed, the sampling basis, exceptions, cut-off date and material limitations. The underwriter can then decide what further information is needed.

The buyer should also distinguish a missing document from missing assurance. A complete list of customer contracts may still leave renewal risk untested. A detailed cybersecurity pack may still omit penetration-test results or evidence of remediation. The matrix should describe the assertion being tested, not merely the file expected.

Every unresolved matter should have an owner, latest safe resolution date and fallback. The fallback can include additional diligence, a management certificate, seller recourse, price adjustment, covenant, condition, special insurance, exclusion acceptance or withdrawal.

Evidence quality can be assessed across four dimensions. Completeness asks whether the relevant population is present. Authenticity asks whether the material is final, executed and attributable to the correct entity. Currency asks whether it covers the period relevant to the warranty. Testability asks whether an adviser can use it to reach a conclusion. A file can pass one dimension and fail another. For example, a complete customer list may be current and authentic while remaining insufficient to test contractual change-of-control rights.

The buyer should avoid filling gaps with unsupported management estimates. An estimate can be useful where it is identified, its method is explained and the underlying data is available. It should not silently replace a source record. Where the insurer relies on an estimate, the underwriting record should preserve the assumptions, sensitivity and management owner.

7. Run a critical evidence-gap register

The gap register turns data-room quality into an executable worklist. It should focus on matters capable of affecting coverage, price, closing or residual exposure. Low-value administrative requests can remain in the ordinary Q&A process.

Counts, dates and outcomes are hypothetical and do not represent market benchmarks.

The hypothetical case begins with 27 critical gaps. Fourteen are resolved through complete evidence and diligence. Eight are partly resolved and require a qualification or further action. Five remain open at the proposed signing gate. This result should not be converted into one simple pass or fail. Each open matter should be assessed against the relevant warranty, expected exclusion and transaction economics.

The register should record when the source was requested, received, reviewed and accepted. Acceptance should come from the accountable diligence lead rather than the uploader. If a document resolves only part of the question, the status should remain partial and describe the remaining uncertainty.

The waterfall should not imply that partially resolved gaps are harmless. They remain active until the buyer identifies the precise residual uncertainty and the transaction response. The five open matters in the scenario are therefore reported separately to the acquisition committee, with their policy and valuation consequences.

Prioritisation should reflect both consequence and the time needed to obtain reliable evidence. A low-probability ownership defect may outrank a more likely minor commercial dispute because the ownership issue can affect title, financing and closing. The register should therefore include severity, dependency and latest safe action date rather than rank matters by probability alone.

8. Control management Q&A as evidence

Management Q&A is often the only practical route to explain business processes, unusual transactions, disputed facts or missing history. It can also become an uncontrolled stream of oral statements, duplicated questions and ambiguous answers. The buyer should treat it as evidence with named ownership and version control.

Each material question should identify the warranty or diligence issue, source documents already reviewed, precise information required, responding executive, reviewer and due date. The response should distinguish fact, estimate, opinion and planned remediation. Supporting documents should be linked and stored in the authorised repository.

Oral sessions should produce a contemporaneous written record. Participants should confirm corrections promptly. A statement by one manager should not be attributed to the entire seller group without authority. Where management cannot verify a point, the record should say so and the risk should remain open.

The underwriter's questions should enter the same controlled register. This avoids one answer being given to the buyer's counsel and a different answer being given to the insurer. It also allows the disclosure letter and diligence reports to be updated when a response changes the factual position.

The fields are a governance framework and should be adapted to the transaction and applicable confidentiality requirements.

The register also helps identify systemic uncertainty. Repeated statements that records are unavailable can reveal a control weakness rather than isolated missing documents. The buyer should consider whether that weakness affects financial statements, compliance, valuation or integration plans beyond the individual warranty.

Management responses can create new diligence obligations. If an executive explains that a material customer arrangement is undocumented, the team may need to test revenue recognition, enforceability, concentration and renewal assumptions. The Q&A owner should route such responses to every affected workstream.

9. Reconcile disclosure with diligence findings

Seller disclosure and buyer diligence perform different functions. Disclosure qualifies the warranties under the acquisition agreement. Diligence informs the buyer's commercial, legal and financial decision. W&I underwriting considers both. The team should therefore reconcile them explicitly.

A disclosure can be technically broad while remaining difficult to use. General disclosure of everything in a large data room may not tell the buyer or insurer which warranty is affected. Specific disclosure should identify the matter, relevant warranty, entity, period, source documents, financial significance and status. Transaction counsel should advise on the contractual standard.

The buyer should compare each material diligence finding with the disclosure letter. An undisclosed finding requires escalation. A disclosed matter omitted from diligence may require investigation. A change in the warranty wording can alter the relevance of existing disclosure. The reconciliation should be refreshed when the agreement changes.

The final record should also preserve rejected disclosure. If the buyer challenges an assertion or requires more detail, the correspondence can affect later interpretation. The insurer should receive the agreed disclosure package and any material context required for a fair presentation.

Materiality needs one consistent map. The data room, diligence reports, disclosure letter, sale agreement and policy can use different thresholds. A financial diligence report may examine items above one amount, while the warranty contains no materiality qualifier and the policy applies a different de minimis. The reconciliation should show these differences and identify any resulting blind spot.

Disclosure should also be refreshed for changes between the last diligence cut-off and signing. New litigation, customer notices, employee departures, incidents or regulatory correspondence can alter the presentation. The bring-down process should identify who must search for updates, the period covered and the route for urgent escalation.

10. Connect known risks to a separate transaction response

W&I insurance is primarily designed around insured breaches of warranties and specified indemnities subject to policy terms. A known matter may be excluded or require a separate solution. The buyer should identify the response before reducing seller recourse.

Responses can include a specific indemnity, escrow, retention, purchase-price adjustment, completion condition, covenant, tax insurance, contingent-risk cover, remediation programme or acceptance within the valuation. The chosen route should match the loss mechanism and enforceability required.

The risk-allocation register should identify the amount at risk, probability range where supportable, evidence, responsible party, funding source, duration and recovery mechanism. It should prevent one known matter from being described simultaneously as insured, priced and indemnified without explaining how the protections interact.

Known-risk treatment should also enter the acquisition model. A customer-consent problem can impair revenue and valuation. A tax exposure can affect cash, interest and penalties. An intellectual-property gap can delay product delivery. The financial model should show the operating consequence rather than only the legal claim amount.

11. Score underwriting readiness

A readiness score can help the board compare progress over time. It should not predict insurer approval. The score is an internal decision tool based on evidence completeness, diligence quality, disclosure reconciliation, management responsiveness, document control and policy alignment.

In the hypothetical case, the initial score is 62 out of 100. Evidence remediation, completed diligence and reconciled disclosure increase it to 86. The unresolved 14 points relate to five open critical gaps, final policy wording and the bring-down process. The score is accompanied by the gap register so that a high aggregate result cannot hide one decisive exclusion.

Suggested weightings are 25 points for source evidence, 20 for diligence scope and conclusions, 15 for disclosure quality, 10 for management Q&A, 15 for sale-agreement and policy alignment, 10 for document control and five for bring-down readiness. Weightings should reflect the transaction and sector.

The committee should set minimum evidence conditions rather than a single numerical threshold. For example, title, sanctions, authority and material financial-statement work may be mandatory regardless of the overall score. A score of 86 cannot compensate for an unresolved ownership defect.

12. Model the progression from indication to executable cover

An insurer's initial indication commonly depends on assumptions, underwriting and satisfactory diligence. The buyer should distinguish possible capacity from coverage supported by the current evidence. The case model uses a hypothetical coverage-readiness estimate to show that distinction.

The estimate begins at 58 per cent because the warranty set and indicative capacity exist while evidence gaps remain. It increases to 76 per cent after the disclosure letter, diligence findings and management responses are reconciled. It reaches 88 per cent after a residual-evidence plan is agreed. The remaining 12 per cent reflects open matters and final wording.

The model should never be presented as an insurer probability. It is a governance device for the buyer. Actual coverage depends on underwriting, policy wording, applicable law, insurer authority and the final facts.

13. Quantify the economics of residual exclusions

The board should understand how data-room quality affects the financial bargain. An exclusion can remove protection for the risk that matters most. A condition can delay binding. A narrow definition of loss can reduce recovery. The policy limit therefore needs to be analysed alongside excluded and retained exposure.

The hypothetical transaction has enterprise value of USD 320.0 million, equity purchase price of USD 245.0 million and a proposed policy limit of USD 32.0 million. The retention is USD 2.4 million and assumed premium, tax and underwriting cost is USD 0.8 million. These amounts do not show whether the policy protects the investment case.

The team identifies USD 18.0 million of scenario exposure associated with matters initially at risk of exclusion. Evidence and transaction responses reduce that amount to USD 6.0 million at the signing gate. These values are internal hypothetical estimates, not claims forecasts. The residual amount is allocated among seller recourse, price protection, remediation and buyer risk acceptance.

The investment paper should show policy limit, retention, cost, excluded-risk estimate, seller recourse and buyer residual exposure in one table. It should also show timing. A recovery after a lengthy claim process cannot be treated as cash available at closing.

The model should contain at least three cases. The first assumes the intended coverage and agreed known-risk responses. The second applies the material expected exclusions and retention. The third tests a delayed or disputed recovery while the operating loss occurs immediately. The cases should measure liquidity and covenant consequences as well as ultimate loss.

The buyer should also test aggregation. Several warranty breaches may arise from one underlying event and consume the policy limit together. Defence costs, tax gross-up, mitigation expenditure and third-party recoveries can be treated differently under the wording. Transaction counsel, the broker and finance team should reconcile these mechanics before the board relies on the headline limit.

14. Govern the evidence cut-off and version record

Underwriting must rely on an identifiable evidence set. The buyer should establish cut-off dates for diligence reports, the data-room index, disclosure, management Q&A and policy negotiations. Files added after a cut-off should be logged and assessed for materiality.

The final archive should preserve the index and the file hashes or other reliable identifiers for material documents. It should record the version of each diligence report shared with the insurer, the disclosure letter, acquisition agreement, policy, underwriting presentation, insurer questions and responses.

Version control matters because small drafting changes can alter risk allocation. A final warranty may differ from the draft reviewed by the insurer. A disclosure schedule can change after the underwriting call. A diligence report can remove a limitation after supplemental work. The policy should be checked against the final transaction documents.

The archive should be accessible after closing to the policy owner, legal team and claims personnel, subject to privilege and confidentiality controls. The transaction team should not be the only group capable of reconstructing the record.

The index should also identify documents withheld from particular parties. A clean-team file may have informed a specialist adviser without being available to the wider deal team. The final record should explain the review route and conclusion while respecting the access restriction. This prevents a later reviewer from assuming that an absent file was overlooked.

Changes after signing can matter as well. If the policy attaches at signing but completion occurs later, the buyer may need to notify developments, repeat confirmations or comply with interim conditions. The archive and responsibility matrix should remain active through policy inception and closing.

15. Protect personal data, privilege and clean-team information

Data-room design must comply with privacy, confidentiality, privilege and competition-law restrictions. The UK Information Commissioner's Office advises organisations involved in mergers and acquisitions to consider data sharing as part of due diligence, establish the lawful basis, document the purpose and apply appropriate security. ^[8]

Personal data should be minimised, redacted or aggregated where possible. Access should follow role and need. Special-category data, employee records and customer information can require additional controls. Cross-border transfers should be assessed under the applicable regime.

Legally privileged material requires counsel-led handling. Sharing can affect privilege depending on jurisdiction and circumstances. The insurer may need sufficient information to understand the risk while the buyer preserves legal protections. Transaction counsel should design the process.

Competition-sensitive information can require clean-team access, aggregation or staged disclosure. The underwriting timetable should accommodate these controls. Security should include authentication, access logs, download restrictions, revocation, incident response and monitoring proportionate to the transaction.

16. Use technology with accountable review

Technology can improve indexing, duplicate detection, optical character recognition, search, contract extraction, issue coding and reconciliation. It can also create false confidence if outputs are treated as verified facts. The buyer should define which tasks are automated, which require professional review and how exceptions are handled.

An extraction tool can identify change-of-control clauses across contracts, yet counsel should validate the population, clause meaning, amendments and governing law. A language model can help cluster Q&A, yet confidential data handling, hallucination risk, access controls and human verification require governance. A scoring tool can prioritise gaps, yet the deal team remains responsible for the decision.

The technology record should state the source population, tool version, prompt or configuration where relevant, reviewer, validation sample, exceptions and final approval. Material conclusions should link back to source evidence. The insurer should understand when analysis relies on machine-assisted processes.

Technology should also support deletion and retention. Copies created for analysis should be controlled, secured and removed when no longer authorised. The buyer should avoid creating an unmanaged shadow repository.

Quality assurance should use both precision and recall. Precision asks whether extracted issues are genuine. Recall asks whether the system found the relevant population. A tool that accurately identifies clauses in the files it reads can still fail if scanned appendices, compressed archives or foreign-language documents were omitted. The validation plan should therefore test the ingestion population and the extracted output.

The deal team should maintain a human escalation route. High-risk clauses, low-confidence extractions and conflicting documents should move to specialist review. The output should record who accepted the conclusion. This control becomes especially important when analysis affects disclosure or an insurer's understanding of the risk.

17. Align product governance and distribution responsibilities

Insurance distribution and product-governance requirements can shape the placement process. The FCA's PROD sourcebook addresses insurance product governance and distribution arrangements, including information and review responsibilities within its scope. ^[2] The Insurance Distribution Directive establishes EU rules for insurance distribution. ^[5]

The buyer should identify the regulated entities in the placement, their roles, the carrier providing capacity and the party responsible for policy documentation and claims. Broker and insurer responsibilities should be recorded without assuming that one adviser owns every transaction decision.

Product information should be clear enough for the buyer to understand coverage, exclusions, conditions, duration, premium and claim procedure. EU measures concerning insurance product information emphasise presentation that is clear and easy to read, although the precise application depends on the product and customer. ^[6]

The transaction team should verify licensing, delegated authority, financial security, governing law and dispute forum. It should also confirm premium payment, tax, inception and any condition precedent to cover.

18. Build an underwriting risk heat map

The heat map helps the committee focus on evidence weaknesses with the greatest transaction consequence. It should be based on the current gap register and refreshed at each decision gate.

Customer consents, tax positions and regulatory permits sit in the upper-right quadrant in the hypothetical case. They require transaction responses alongside insurance analysis. Version control and management Q&A remain important controls with lower immediate financial consequence.

Every plotted item should have an owner and action. A visual without the underlying register is decorative. The committee should be able to trace each point to the evidence, proposed response and deadline.

19. Use decision gates before binding bid and signing

The buyer should operate at least three gates. The evidence-design gate occurs before substantive diligence. It approves the warranty matrix, index standards, critical-risk categories and access controls. The binding-bid gate tests whether the evidence supports the bid's proposed seller recourse and insurance assumptions. The signing gate confirms policy wording, disclosure, conditions, premium and inception.

At the binding-bid gate, the committee should receive the readiness score, critical-gap register, expected exclusions, known-risk responses, timetable and fallback. It should know which elements remain indicative. It should avoid releasing seller security solely because a broker or insurer has expressed appetite.

At signing, the team should reconcile the final acquisition agreement, disclosure letter, diligence reports, underwriting record and policy. Any difference should be resolved or accepted explicitly. The committee should see the residual exclusions, retention, limit, seller liability and buyer exposure.

The fallback can include preserving escrow, changing price, narrowing warranties, obtaining a specific indemnity, delaying signing, adding a condition or accepting the risk. It should remain available until the policy and transaction are executable.

Each gate should contain a dissent route. A diligence leader, counsel or information-security officer should be able to flag a material unresolved matter even when the overall programme appears ready. The committee should record whether the concern is resolved, mitigated or accepted and why.

The gates should also be tied to authority. The person approving a reduction in seller recourse may require different authority from the person approving premium or data access. The decision paper should distinguish these approvals and retain evidence of them.

20. Implement the control system in five phases

Timing is indicative and should follow the acquisition, diligence, insurance and regulatory timetable.

Phase one creates the architecture. Phase two mobilises evidence and separates critical gaps from ordinary requests. Phase three reconciles the legal, financial and management records. Phase four supports underwriting and wording. Phase five preserves the record and transfers ownership after closing.

The programme should have one accountable executive, usually the deal lead, supported by transaction counsel, the broker, diligence leaders, information-security personnel and the seller's process team. Each adviser remains responsible for work within its mandate.

Weekly reporting should show gaps opened and closed, overdue management questions, documents added after cut-off, diligence limitations, disclosure changes, underwriter questions, expected exclusions and decision deadlines. Reporting should remain short enough to drive action.

The operating rhythm can use a daily critical-issues meeting during the final underwriting period. The agenda should cover new evidence, unresolved insurer questions, changes to the acquisition agreement, disclosure updates, policy drafting and decisions due within the next two business days. Actions should enter the controlled register immediately.

After closing, the buyer should conduct a short control handover. The policy owner should receive the executed documents, notice requirements, claim contacts, retention tracking, seller-recourse schedule and outstanding remediation. Integration teams should know which events require escalation and which evidence must be preserved.

Performance measures should remain operational. Useful measures include the percentage of material warranties mapped to reviewed evidence, critical gaps past their safe resolution date, management questions without an accountable respondent, late files awaiting diligence review, disclosure items without a source link and policy exclusions without an approved transaction response. These measures show where execution can fail. A raw total of uploaded files does not.

The programme should include an independent final check by someone who did not prepare the principal matrix. The reviewer should sample warranties in both directions: from warranty to evidence and from material finding to disclosure and policy treatment. The sample should include high-risk, restricted and late-added information. Exceptions should be resolved before the signing gate or recorded as residual risk.

The same control design can support future claims. A claim team may need to prove the warranty, breach, loss, disclosure history and information supplied to the insurer. A well-governed archive reduces the time needed to reconstruct those facts. It does not determine coverage, which remains governed by the executed policy and applicable law.

21. Conclusion

An insurer cannot price a data-room file count. It prices a risk presented through evidence, analysis, disclosure and policy wording. The buyer's task is to build a controlled chain between those components and preserve it through signing.

The hypothetical case shows the governance value. A repository containing 1,860 files begins with 27 critical gaps and an underwriting score of 62 out of 100. The remediation programme resolves 14 gaps, partly resolves eight and leaves five open. The score increases to 86, while the hypothetical coverage-readiness estimate increases from 58 per cent to 88 per cent. The remaining matters still require explicit transaction responses.

The reusable method is practical. Begin with the warranties. Index the evidence. Separate missing from adverse information. Control management answers. Reconcile diligence and disclosure. Record known-risk responses. Quantify residual exclusions. Freeze the evidence set. Protect restricted information. Use technology with accountable review. Bind only after the final documents and policy tell the same story.

Sources

1. United Kingdom, Insurance Act 2015, Part 2 duty of fair presentation and remedies, Read the primary source
2. Financial Conduct Authority, Product Intervention and Product Governance Sourcebook, Chapter 4 insurance product governance and distribution, Read the primary source
3. Financial Conduct Authority, Product Intervention and Product Governance Sourcebook, Chapter 1 application, Read the primary source
4. Financial Conduct Authority, Insurance Conduct of Business Sourcebook overview, Read the primary source
5. European Union, Directive (EU) 2016/97 on insurance distribution, Read the primary source
6. European Union, Commission Implementing Regulation (EU) 2017/1469 on the insurance product information document, Read the primary source
7. European Union, Commission Delegated Regulation (EU) 2017/2358 on product oversight and governance requirements for insurance undertakings and distributors, Read the primary source
8. Information Commissioner's Office, Data sharing due diligence in mergers and acquisitions, Read the primary source
9. Information Commissioner's Office, Data Sharing Code of Practice, Read the primary source
10. Lloyd's, Transactional liability W&I, tax and contingent-risk codes, Market Bulletin dated 16 June 2025, Read the primary source
11. AIG, M&A Claims Reports, Read the primary source
12. AIG, Representations and Warranties Insurance, Read the primary source
13. United States Securities and Exchange Commission, Management's report on internal control over financial reporting and acquired businesses, Read the primary source
14. United States Department of Justice and Securities and Exchange Commission, A Resource Guide to the U.S. Foreign Corrupt Practices Act, Second Edition, Read the primary source
15. United States Securities and Exchange Commission, Financial reporting and auditing considerations of companies merging with SPACs, Read the primary source