Ardcarne Life Assurance / BG-Demo – Onboarding
Callscheduled
Ardcarne Life Assurance · 13 Oct 2026 10:15
Fourth security review session: four open findings on incident actions, notification wording, the exit plan and subcontractors. All remain open, with dated written commitments due. The call is dated after the as-of date.
What was said
What this says
As at Fri 9 Oct 2026Fourth security review session: four open findings on incident actions, notification wording, the exit plan and subcontractors. All remain open, with dated written commitments due. The call is dated after the as-of date.
What happened: Declan Furlong listed four open findings and Theo Gallagher took owners and dated actions on each. Declan said dated commitments are required under DORA and that the session does not close the review.
Customer view: Declan wants detection, classification and notification stated separately, named contacts in the contract schedule, and a tested exit plan. Aoife Kinsella said nothing is agreed until Legal has seen it.
Commercial: Matteo Ricci said the target close is Fri 4 Sep 2026 and is not a commitment. He mentioned a total of £155k on the draft; the evidence does not show what it covers.
Watch: The call is dated 13 Oct 2026, after the 9 Oct 2026 as-of date, so treat it as booked until confirmed held.
Themes
As at Fri 9 Oct 2026Theme
DORA security review findings
Importance
neutral
Sentiment
neutral
Voice
unknown
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher to send one pack by end of day Friday with dated actions, completion evidence and notification wording.
- Theo Gallagher to send the exit plan draft and the tabletop exercise proposal by end of day on the following Friday.
- Matteo Ricci to confirm the post-signature change mechanism, including regulator-required changes, in writing on Thursday.
Risks
As at Fri 9 Oct 2026- All four findings remain open, so the target close date may move, as Matteo Ricci acknowledged.
- The exit plan is still a draft and has not been tested, and Legal must approve wording on derived data and termination assistance.
- Notification is measured from classification in the draft, which the customer has said it will push on.
Opportunities
As at Fri 9 Oct 2026- Closing the findings with evidence would clear the way for the commercial documents Matteo agreed to hold.
- A tabletop exit walk-through during onboarding was offered and could be written into the exit plan as an action.
Call prep
As at Fri 9 Oct 2026First onboarding call since the 6 Oct 2026 kickoff on a £125k a year Enterprise contract. Niamh Costello asks 28% of questions so far. The nightly extract, the duplicate broker records ticket and her dashboard request will decide how fast use widens.
Context: Niamh Costello is the only customer attendee and the main user so far. She has said she will watch the first weeks closely and wants early warning if usage lags.
Approach: Start with the nightly policy administration extract, since it sets the first connector group and the first view date. Then give a straight update on the duplicate broker records ticket before discussing the dashboard.
Watch for: Signs that the extract cannot be reused, or that duplicates are denting trust in the broker view. Theo Gallagher owes Declan Furlong evidence; check before the call whether it has gone.
Booked
Updated 9 Oct 26Date2026-10-13
Time10:15
Typeonboarding
Statusscheduled
Callsmade from
Transcript
Theo GallagherMorning, both. Declan, Aoife, can you hear me all right?
Declan FurlongGood morning, Theo. Yes, clearly.
Aoife KinsellaMorning. Sorry, I was finishing something else, I'm here now. Is Matteo on?
Matteo RicciI am, buongiorno. Apologies, I was on mute. Thank you for making the time. I know this is the fourth session and everyone's diary is under pressure.- Declan FurlongShall we start? As before, I'll list the open findings so we are all working from the same record. There are four. One, the post-incident review for the July outage, specifically the corrective actions and their dates. Two, the notification commitment, in writing, in a form I can use for the register of information. Three, evidence for the exit plan. Four, the list of subcontractors that touch the service. Is that your understanding, Theo?
- Theo GallagherThat matches mine, Declan. I'd add owners, so there's no ambiguity. Finding one is mine, with input from the platform team. Finding two is mine and Matteo's, because the wording ends up in the order form. Finding three is Aoife's and mine. Finding four is mine alone, and I think it's the closest to done.
- Matteo RicciIf I may, before we go in, let me restate the timeline as I understand it, so nobody is surprised. The target is to close on Friday 4 September 2026. That is a target, not a commitment, and it depends entirely on these findings being closed to your satisfaction, not on my diary.
- Aoife KinsellaThank you, Matteo. I would just note, from an outsourcing perspective, that the date follows the policy steps and not the other way round.
- Matteo RicciUnderstood. That is exactly how I would like it to be.
- Declan FurlongThen finding one. Theo, I have read the post-incident report. I would rather you did not summarise it. Walk me through the corrective actions and tell me which are complete.
- Theo GallagherOf course. I'll split them into done, in progress and not started, because I don't want to blur them. The done ones, we can evidence that: there is a change record and a review sign-off for each, and I'll show you in a moment. The in-progress ones each have an owner on our platform team, but I don't yet have an agreed completion date for each, and I'm not going to give you a date I haven't confirmed with the platform team lead. The not-started ones are improvements to monitoring and to how we communicate during an incident. Again, they need dates. So that's the honest position: the report is accurate, but the dating of the remaining actions is incomplete.
- Declan FurlongSo some of the dates are not yet agreed.
- Theo GallagherCorrect.
- Declan FurlongI appreciate the candour, but under DORA we need dated commitments, not intentions. A corrective action without a date is a finding that stays open. Please provide a dated commitment for each in-progress item and each not-started item.
- Theo GallagherHere is the dated commitment I can give today. I'll take each open action to the platform team lead tomorrow, and you will have a written list with owners and dates by end of day Friday. If a date can't be confirmed by then, the list will say so plainly, and I'll flag it to you before Friday, not after.
- Declan FurlongEnd of day this Friday.
- Theo GallagherYes, this Friday. I'm aware that's only three days, so I would rather say 'not yet confirmed' than invent one.
- Declan FurlongGood. And I want the evidence for the completed actions in the same pack, not as a separate message.
- Theo GallagherUnderstood. Same pack.
- Matteo RicciDeclan, may I add something on the incident itself? I would rather you heard it from me: if there is any further incident during onboarding, or before, your team hears it from us first, and from me personally on the commercial side. I said that in July and I'd say it again.
- Declan FurlongI recall it. You were the first to tell me, and I recorded that. It counts in your favour, Matteo, but it does not replace a commitment. Which brings me to finding two. The notification time. Under DORA we must be able to report major incidents to the Central Bank within the regulatory windows, which means you notifying us well inside them. What is the commitment, and where is it written?
- Theo GallagherIt sits in the security schedule and in our answer to the questionnaire item on incident notification. I'm not going to quote the figure from memory, because I'd rather be exact: I'll paste the wording into the pack. What I can say is that, as drafted, it is measured from the point we classify an incident, and I know that's the part you'll push on.
- Declan FurlongI will. 'From classification' is not the same as 'from detection'. Please state both, and say who classifies, by role.
- Theo GallagherNoted. I'll set out detection, classification and notification as three separate points and name the role that classifies. If the schedule only defines one of them, I'll tell you so, and then we need an amendment rather than a reading of the existing text.
- Matteo RicciAnd if an amendment is needed, let me confirm that in writing with our legal team. I don't want to say anything on this call that I can't stand behind.
- Declan FurlongThat's acceptable. Please also keep that wording consistent with whatever the exit plan says about notification during a transition.
- Theo GallagherWill do. Before we move on, let me share my screen so you can see the change records for the completed actions. It's easier than me describing them. Bear with me, this takes a moment.
- Declan FurlongTake your time.
- Theo GallagherRight. That is the change record for the first completed action, and the review sign-off beside it. Each completed action has the same pair. The pack will contain exactly these documents, so you can keep them with your file.
- Declan FurlongI can see the dates on the records. I accept this one as evidenced. I will need the same view for the others before I close anything. Let us move on.
- Aoife KinsellaFinding three. Can I first confirm which draft we are on? I have the exit plan schedule circulated last week, which Theo marked as a draft.
- Theo GallagherYes, that's the one. It is a draft, and I'd like it to stay called a draft until you and Legal are content.
- Aoife KinsellaThank you. The exit plan needs to cover three things from our side: the transition period, termination assistance, and what happens to anything derived from our data after we leave. So indexes, summaries, anything the brain has built.
- Theo GallagherThat's a fair list. The structural point, which we can evidence, is that the brain runs inside your own Snowflake account. Your source data is never held by us. So exit is largely about removing our access and our application layer, and agreeing what happens to derived tables that already sit in your account. Those are yours to keep or delete.
- Aoife KinsellaI would want that stated, not implied.
- Theo GallagherAgreed, it should be a clause. I'll propose wording on derived data and on removal of access, with a timescale for revoking credentials. The length of the transition period and what we do within it needs a view from beyond me, so I'll ask the platform team and our legal team rather than offer something.
- Aoife KinsellaThat is the part Legal will read most carefully. Please do not tell me it is standard.
- Matteo RicciI wouldn't. What does your regulator need to see on termination assistance? If you tell me what the outsourcing register expects, I can make sure our wording answers that, rather than ours.
- Aoife KinsellaThe register needs the exit strategy, whether the service is substitutable, and the transition arrangements. I'll send you the headings after the call. To be clear, I'm not agreeing anything today. All of this is subject to Legal.
- Matteo RicciOf course. That is how I'd expect it.
- Declan FurlongFinding four. The list of subcontractors. I received a list. I need confirmation that it is complete, and that any change is notified to us in advance.
- Theo GallagherThe list I sent is current as of this week. Advance notification of change is in the draft, but I want to check the notice wording before I say more than that. I'll include it in the pack.
- Declan FurlongPlease do. And I would like any subcontractor with access to customer data flagged separately from those without.
- Theo GallagherYes. The list already has a column for it, I'll make it much clearer.
- Declan FurlongOne more point for the register of information. Is the exit plan tested? A plan nobody has exercised is a document, not a control.
- Theo GallagherI agree with that, and I'm not going to overstate it. We have not run a joint exercise with you, obviously, because you aren't live. What I can offer is a tabletop walk-through of the exit steps with your team during onboarding. I'd put that in as a proposed action with an owner, rather than a promise on this call.
- Aoife KinsellaA tabletop exercise would help the policy file. Please include it in the draft as an action with a timing, and I'll take a view on whether it should be a clause.
- Declan FurlongReturning to finding one for a moment. Among the not-started actions you mentioned communication during an incident. What exactly will change for my team? Who calls whom, and when?
- Theo GallagherRight. As it stands, the improvement is a named contact on your side and a named contact on ours, with a route that works outside business hours, so that notification doesn't depend on whoever happens to be at their desk. The detail of the roles is one of the items I need to take to the platform team lead, so I'll put it in the Friday list with an owner and a date. I don't want to describe a rota I haven't seen agreed.
- Declan FurlongThat is the kind of answer I can work with, provided it arrives in writing. I would add that I will want the named contacts in the contract schedule, not only in an email. In the July outage the information reached us through more than one route, and I could not tell which was authoritative. That is what I need to see eliminated.
- Matteo RicciThat's a fair criticism, Declan, and I won't argue with it. One authoritative route, named in the schedule. I'll make sure that is in the draft Legal sees.
- Declan FurlongThank you. Now, Theo, the evidence for the in-progress actions. When they are completed, what will you send me, and how will I know it is the same item?
- Theo GallagherEach action in the Friday list will carry the same identifier as the report, so you can trace it. When it completes, you get the change record and the sign-off, the same pair you have just seen. If an action is closed in a different way, say a decision not to proceed, I'll say that explicitly and give the reason, so you can decide whether you accept it.
- Declan FurlongGood. I do not accept 'not proceeding' without a reason and an alternative control.
- Theo GallagherUnderstood. No reason, no closure.
- Aoife KinsellaMatteo, while we are all here. From procurement's side, I'd like to understand how any change to the exit plan after signature is handled. If our regulator asks us to amend the exit strategy, what is the mechanism?
- Matteo RicciLet me confirm that in writing, Aoife, because I'd be guessing. My understanding is that changes go through the order form and the agreement, but I want our legal team to tell you the mechanism, and whether a regulatory change is treated differently. I would rather give you a correct answer on Thursday than a quick one now.
- Aoife KinsellaThursday is fine. Please make sure the answer addresses a change required by the regulator, not only one we request.
- Matteo RicciNoted, both cases.
- Declan FurlongApologies, I stepped away to check one of the earlier clauses against our policy. It is fine. Let me summarise where we are, and correct me if I have anything wrong. Finding one remains open, pending dated actions and the evidence. Finding two remains open, pending the exact wording on detection, classification and notification. Finding three remains open, pending the revised exit plan draft. Finding four I am minded to close once I have the notice wording for subcontractor changes.
- Theo GallagherThat's my record too. To restate the dated items. By end of day Friday: the written list of corrective actions with owners and dates, the completion evidence, and the notification wording, all in one pack. By end of next week, the Friday after this one: the exit plan draft with proposed clauses on derived data and removal of access, and the tabletop exercise as a proposed action.
- Declan FurlongPlease write the day of the week in the email, not only 'next week'. I need to be able to show the Central Bank a commitment with a date on it.
- Theo GallagherFair. I'll put the day in the subject line and the body, and I'll copy Matteo so the commercial timeline sits against it.
- Aoife KinsellaAnd I'll send the register headings tomorrow. Matteo, I would ask you not to send any commercial documents until the exit plan is settled.
- Matteo RicciUnderstood, I'll hold them. Forgive me, I'll only say that the total on our draft is £155,000, and that I won't raise it again until the exit plan is settled.
- Aoife KinsellaNoted, and thank you for stopping there.
- Declan FurlongOne last thing from me. I have been asked internally whether this session closes the review. It does not. It closes the sessions. The review closes when the findings close, with evidence, and not before.
- Matteo RicciThat is entirely clear, and I would not wish it otherwise. If the findings take longer than the target, then the target moves. I'd rather tell you that early than have you find out late.
- Declan FurlongThen we understand each other. Thank you, Theo, thank you, Matteo. Aoife, anything further?
- Aoife KinsellaNothing further. I'll look for the exit plan draft and the answer on regulatory change, and I'll send my headings tomorrow.
- Theo GallagherThanks, all. The pack comes by end of day Friday, with the day in the subject line. If anything slips, you hear from me before then.
- Matteo RicciGrazie, everyone. Speak soon.
- Declan FurlongRegards, both. Goodbye.
Callsmade from