About Chaucer
- What it is: a leading specialty insurance and reinsurance group, underwriting at Lloyd’s of London through Syndicates 1084 and 1176, founded in 1922.
- Scale: headquartered at 52 Lime Street, London, employing over 670 people worldwide, including more than 250 specialist underwriters; Syndicate 1084 alone wrote US$2.46bn of gross premiums in 2025, at a combined ratio of 88.2%.
- Footprint: offices in London, Bermuda, Singapore, Dubai, Copenhagen, Sydney, Ipswich, Manchester and Dublin, with a hub in Miami.
- Listing: Chaucer is not separately listed. It is a member of the China Re Group; its ultimate parent, China Reinsurance (Group) Corporation, is listed on the Hong Kong Stock Exchange.
Company facts from Chaucer Group and Syndicate 1084’s published 2025 accounts, checked November 2026.
Where did Chaucer start?
A regulated insurer does not lack controls: it has them in abundance (governance, risk, audit, compliance), because the FCA and PRA expect them and the business cannot operate without them.
What ISO 27001 adds is a single, independently audited management system that draws those arrangements together and evidences them coherently, to regulators, to brokers and coverholders, and to the market.
I was brought in as GRC Lead, on contract, specifically to implement that system, and subsequently joined permanently to run the function I had built.
My starting point is always the same: remove any mystique about what the standard requires, and understand what already exists before proposing anything new. In an organisation of this maturity, most of the raw material is already there, and the work is in the joining up.
What did I do at Chaucer?
In brief, I led the implementation of the management system:
- Agreed a certification scope that sat sensibly within a regulated group structure.
- Mapped what already existed (policies, risk processes, governance forums) against the standard, so the business was not asked to build twice what it already had once.
- Built the risk assessment and Statement of Applicability with the people who owned the risks, in underwriting support, claims, IT and the functions around them.
- Aligned the supplier oversight expected by the standard with the outsourcing discipline a regulated firm already carries, including its technology and service providers.
- Put the operating rhythm in place (internal audit, management review, evidence gathered as a habit) and prepared the organisation for independent assessment through to certification.
What was the difficult part?
In a large insurer the difficult part is evidence and ownership. An auditor will follow a decision from a committee paper to a system setting to a person who can explain both, and where hundreds of people touch the same process that chain has to be deliberate.
Restraint matters too: a regulated firm can drown a management system in governance, and a system nobody can operate between audits is worth very little.
What was the outcome at Chaucer?
Chaucer achieved independent ISO 27001 certification for the agreed scope, and certification was the decision of the independent certification body, as it always is. My role was to make sure the organisation met that assessment prepared, with a system it could retain afterwards, and in the event I stayed to run it: I now hold the Head of IT Security GRC role, so the system has to survive my own surveillance audits.
I have built my practice on mutual trust and understanding, and regulated firms tend to value the same quality in a management system: it does what it says, and someone named owns it.
Is your situation similar?
If you are an insurer, broker, MGA or financial services firm weighing certification against your existing regulatory obligations, I have set out how the two fit together on my insurance and financial services page. I am always happy to answer questions, so feel free to drop me an email, anytime.