"Southern Response reviewed TCIL's feedback and carried out its own assessment of the information, before making its independent decision on the request and the redactions applied.
"Consultation with third parties is a standard process Southern Response follows for all OIA requests which concern third-party information," he said.
But he said Southern Response was not aware of any specific guidance from the Ombudsman on the third party's right to charge the agency for its time dealing with OIA consultation.
"When an OIA request involves large volumes of information from a third party, Southern Response may consider that party's request to be reimbursed for their time and resources."
Southern Response had identified about 34 OIA requests about TCIL and would have consulted it on most, if not all, of them, he said.
The insurer paid TCIL twice for reviewing OIAs.
"On two occasions Southern Response has reimbursed TCIL for the cost of labour and materials for reviewing OIA material as part of its third party consultation process."
National MP Gerry Brownlee, who was quake recovery minister at the time the OIA request was made, told the Herald it was "very odd".
Southern Response initially engaged TCIL in 2014 to keep staff safe. But according to a review of the use of external security firms by government agencies, the arrangement morphed into protecting Southern Response's brand.
Documents released by Southern Response also show TCIL suggested amendments to answers to written questions to Brownlee from Woods in 2016.
In September 2016, Southern Response's then-communications manager Linda Falwasser sent a copy of its response to a written parliamentary question to TCIL director Gavin Clark. The question was from Woods, who asked Brownlee: "Has Southern Response hired any private investigators in the past three years; if so, why, at what cost and for what reason."
Clark responded: "I have made some suggested amendments below in red but either version says what you need to say."
TCIL also appeared to advise Southern Response on how to circumvent public scrutiny.
One email from TCIL's projects manager to Southern Response's chief executive Peter Rose in 2014 advises him it has a blog but "to get around disclosure, privacy and OIA issues, we normally set up a discreet email address for you – in Gmail or similar ... do you want us to set up a discreet email account for you – or do you want to?"
Clark told the Herald that email was "an ill-advised statement by a former employee who was reprimanded for it at the time".