What IT monitoring misses in a large insurer

Opening context

Large, regulated insurance organizations run demanding IT environments. Distributed workforces across multiple locations. Functions carrying significant regulatory and decision-making weight. Operational tooling — service desk platforms, ticket systems, availability dashboards, post-change surveys — already in place and providing genuine value for what they capture.

One large regulated insurer reached a point that most mature IT functions eventually reach: decisions approaching on support models, application strategy, and infrastructure investment, with an operational picture that was accurate, well-maintained, and incomplete.

What the independent record surfaced had not appeared in any existing reporting — and in several cases, could not have.

The situation

Operational data confirms what has been built. Ticket volumes confirm what has been reported. Neither confirms how IT actually lands — across roles, locations, and the friction that never reaches a ticket because the person experiencing it has already found a workaround, accepted the drag, or learned not to raise it.

For a large insurer, this gap carries specific weight. The functions under the sharpest regulatory and decision-making pressure are often the functions where IT friction is most acute — and least visible to the teams responsible for it. The IT picture available to leadership was built on systems that reflect ownership: what was built, what was resolved, what was measured by the people responsible for it.

“The operational record we had was useful. What it didn’t show us was the day-to-day reality of the people doing the work.”
— IT Executive, InsureCo

The organization was not in a position of IT failure. It was in the position every large insurer with mature operational tooling is in: working from a picture that is accurate as far as it goes, without a reliable way to know where it stops.

What the independent record showed

1. The highest-influence service had not registered as a priority

Remote IT support carried the highest influence score of any service in the assessment — the single factor most correlated with how IT overall was experienced across the organization. It was performing significantly below the level at which that influence becomes damaging. It had not generated escalation. It had not appeared as a priority in any existing operational reporting.

The independent record ranked it as the primary area for action — not because someone had argued for it, but because the evidence placed it there.

Several other services — meeting room technology, business applications, IT change communication — returned scores in the bottom half of the record without having generated ticket volumes proportionate to their presence in the workforce’s daily experience.

The gap between what operational data showed and what the independent record showed was not marginal. It was structural.

2. The triage tool that the workforce experienced as broken support

The organization had deployed an automated triage tool as a first-line response, designed to handle routine requests and reduce load on the service desk. In the independent record, it generated responses at significant volume. The consistent picture across those responses was not that the triage function had failed. It was that the workforce had experienced it as IT support that didn’t work.

The tool had been deployed with a specific intent. The workforce had experienced something different. That gap — between the deployed design and the operational reality — had not appeared anywhere in the IT team’s reporting.

Without the independent record, it had no mechanism to surface.

3. The ticket claim that the room immediately contradicted

The priority findings placed a core HR and finance platform at the top of the record. When those findings were presented to senior IT and business leaders, the IT function’s initial response was that they had not received a single ticket for that platform.

Every senior leader in the room then agreed, amongst themselves, that it was actually difficult to use.

The ticket claim was accurate. There were no tickets. The platform had generated frustration at significant scale across the qualitative record — characterised consistently as unintuitive, confusing, and increasingly difficult following recent changes — and none of it had become a ticket. The workforce had absorbed the friction. The absence of tickets had been read as the absence of a problem.

When the priority grid appeared on screen, one of the leaders in the room described it as “hitting them in the gut”.

The independent record had made a distinction that ticket data structurally cannot make: the difference between a problem that hasn’t been reported and a problem that doesn’t exist.

4. The infrastructure failure the record surfaced in the act of being taken

During deployment, response rates in two locations came in markedly below the pattern across the rest of the organization. The anomaly was identified and raised with the IT team. When they investigated, they found that a pair of vendor-managed internet proxies had failed silently — undetected by operational monitoring, unraised, and invisible in every availability dashboard the organization had in place.

The end users in those locations could not complete the assessment. Once the proxies were restored, response rates in both locations recovered to the organizational norm.

The independent record had surfaced a live infrastructure failure — vendor-managed, silently failed, unknown to the IT team responsible for it — in the act of being taken. No alert had fired. No ticket had been raised.

The only signal was the gap in the independent record’s own coverage.

5. The function with the most to lose was experiencing IT most acutely

The function carrying the highest regulatory and decision-making pressure in the organization recorded satisfaction significantly below the organizational average. The IT function’s own satisfaction was materially higher. That gap — between the people responsible for IT and the people most dependent on it performing well — appeared in no operational dashboard and no aggregate report.

This is the pattern that matters specifically in insurance. The functions carrying the highest regulatory pressure are frequently the functions where IT friction is most acute and least visible. Aggregate reporting conceals it. The independent record, structured by role, made it specific.

Across the locations served by the same IT function, satisfaction varied by more than thirty points. The distribution was not random — it was structured by geography, by role, and by whether workers were on-site, remote, or field-based.

Decisions made on organizational averages in an environment with that variance carry risk that averages do not show.

What changed

The independent record changed what was prioritized and what was protected.

Remote IT support became the primary area for action — not because it had generated the most visibility, but because it carried the highest operational influence and was performing well below the threshold at which that influence becomes damaging. Meeting room technology had a lower satisfaction score and lower operational influence: a finding that redirected attention from the visually prominent problem to the consequential one.

The triage tool finding created the basis for a conversation that existing data had not enabled: not whether the tool was working as designed, but whether the workforce understood and experienced it as designed. That is a different question. It required a different kind of evidence to ask.

The HR and finance platform moment established that the absence of tickets is not evidence of the absence of a problem. That claim was not made by a consultant or a framework. It was made by the workforce record — and confirmed, in real time, by every senior leader present.

For the IT leadership team, the quality that changed how the function would approach every subsequent decision was specific: evidence produced by the people doing the work, not by the teams responsible for the systems being assessed, not prepared in advance of a presentation, and not adjustable in response to a challenge.

One leader, at the close of the engagement, described it as the new way of doing things.

The outcome

The organization entered its subsequent decision cycles with an independent operational record that its existing systems had not supplied and could not supply. The record did not replace operational data. It completed the picture that operational data is not designed to produce: how IT actually lands, where it doesn’t, and at what cost — ranked by operational influence, structured by role and location, and ready to stand up in a prioritization or investment conversation without further interpretation.

What the IT function discovered through the proxy failure: a vendor-managed infrastructure component had been silently failing in two locations, unknown to anyone responsible for it, and the only signal was the gap in the independent record’s coverage. The record found an IT problem in the act of being taken.

What the HR and finance platform moment established: a system in daily use across the organization was widely experienced as difficult, had generated no tickets, and was invisible as a problem until the independent record named it — at which point every person in the room confirmed it immediately.

These conditions are not unusual. They are present in every large insurer with mature operational tooling in place. The picture those tools provide is accurate, genuinely useful, and incomplete.

The part that is missing is not a marginal detail. It is the ground truth without which confident IT decisions cannot be made.