Testing underwriting controls means checking, through independent evidence, whether a coverholder, MGA or other delegated underwriter follows the authority, rules and processes set out in its binding agreement. Auditors review a sample of risks against the contract, the underwriting guidelines and regulatory requirements.

The aim is to confirm that controls operate in practice, not just on paper. The sections below explain which controls are tested, how files are sampled, what evidence is reviewed and how results are reported.

Which underwriting controls are tested in a delegated authority audit?

A delegated authority audit tests the controls that keep underwriting within the limits the insurer has granted. These include authority limits, risk acceptance criteria, pricing, referral processes, documentation and bordereaux reporting. Each control is tested for design and for operating effectiveness.

The exact scope depends on the binding authority, but a typical delegated underwriting audit covers the following areas:

• Compliance with class of business, territory, limit of liability and policy period restrictions
• Adherence to underwriting guidelines and prohibited risk lists
• Rating, pricing and discount authority
• Referral to the insurer where a risk falls outside delegated authority
• Sanctions, KYC and financial crime checks at the point of binding
• Policy documentation, wording and issuing accuracy
• Premium and bordereaux reporting, including timeliness and completeness
• Product governance and fair value considerations for retail business

For UK business, auditors also consider how Consumer Duty obligations affect underwriting decisions, particularly around target market and customer outcomes.

How do auditors select and sample underwriting files?

Auditors select underwriting files by applying a sampling method that reflects the coverholder's real business, usually combining risk-based and random selection. The sample is drawn from the bordereaux or policy listing and should cover different products, brokers, premium sizes and time periods, with extra attention on higher risk areas.

Sample size is a judgement call. It depends on the volume of business, the complexity of the class, the delegated limits and the results of previous audits. A small niche MGA writing a few hundred policies will be sampled differently from a high volume operation writing thousands.

Good audit sampling usually considers:

1. The total population and how it was obtained, ideally directly from the system rather than a curated list
2. Risks bound close to authority limits or referral thresholds
3. Any renewals, endorsements and cancellations, not just new business
4. Prior findings, so that earlier weaknesses are retested
5. Declined and referred risks, which show how controls work at the boundary

Sampling from a list supplied by the coverholder alone can hide problems. Auditors therefore confirm completeness by reconciling the population to bordereaux or system reports.

What evidence is reviewed when testing a control?

Auditors review documentary and system evidence that proves a control happened at the time of underwriting. Examples include the slip or proposal, underwriting notes, rating calculations, referral emails, sanctions screening outputs and issued policy documents. Evidence is compared with the binding authority and the coverholder's own procedures.

A strong underwriting file review follows a risk from submission to policy issue. The auditor asks whether the information on file supports the decision made. Verbal explanations help with context, but they do not replace contemporaneous records.

Auditors typically combine file evidence with other sources:

• Walkthroughs of the underwriting process with the team who operate it
• System access and permission reports to confirm who can bind and amend
• Management information, referral logs and peer review records
• Training and competency records for underwriters
• Delegated authority documentation, including the binder and any variations

Where a coverholder relies on a spreadsheet or manual rating tool, the auditor will also test that tool for accuracy and version control, since errors can repeat across many policies.

What are the most common underwriting control failures?

The most common underwriting control failures are risks bound outside authority, missing or late referrals, incomplete underwriting rationale, rating errors and inconsistent sanctions or KYC checks. Weak record keeping is also frequent. Most failures come from unclear procedures or manual processes rather than deliberate breaches.

Typical examples seen in delegated underwriting audits include:

• A policy bound for a class or territory not permitted by the binder
• Referral to the insurer made after the risk was bound, rather than before
• Rating overrides applied without documented approval
• Underwriting notes that record the decision but not the reasoning
• Policy wordings issued that differ from the agreed version
• Bordereaux submitted late or with premium and risk data that do not match the file

Often a single root cause sits behind several findings. A missing referral trigger in a system, for example, can produce a run of similar exceptions across the sample.

How are underwriting control test results rated and reported?

Test results are rated according to the severity and frequency of exceptions, and reported in a written audit report. Most firms use a simple rating scale, such as satisfactory, needs improvement or unsatisfactory, with individual findings graded by risk. The report explains each issue, why it matters and what action is recommended.

Clear reporting matters as much as the testing itself. A useful report separates facts from opinion, quantifies exceptions where possible (for example, how many of the files sampled were affected) and ties each finding back to the contract or regulatory requirement it breaches.

Well written findings usually contain:

• The control tested and the expected standard
• What was found, with the number of files affected
• The risk or impact to the insurer and policyholders
• A practical recommendation and a suggested timescale

Reports should be delivered within agreed deadlines so that insurers can act on them while the evidence is still fresh. Findings should also be discussed with the coverholder before the report is finalised, to correct factual misunderstandings.

What happens after underwriting control testing is complete?

After testing, the auditor issues the report, the coverholder agrees management responses with action owners and dates, and the insurer tracks remediation until findings are closed. Serious or repeated failures may lead to follow-up testing, tighter authority limits or, in extreme cases, suspension of the binding authority.

Audit findings and remediation work best when treated as a cycle. The coverholder fixes the issue, provides evidence that the fix has been made, and the insurer or auditor verifies it. Closing a finding on the basis of a promise alone leaves the risk in place.

A typical post-audit process looks like this:

1. The draft report is shared and factual accuracy is confirmed
2. Management responses and action plans are agreed
3. The final report is issued to the insurer and the coverholder
4. Remediation evidence is submitted and reviewed
5. Outstanding items are carried into the next audit or a targeted follow-up review

Insurers also use the results to inform their wider delegated authority oversight, including renewal terms, capacity decisions and the frequency of future audits.

How Otter Audit helps with testing underwriting controls

Otter Audit carries out independent delegated underwriting audits for insurers and coverholders across Lloyd's, the London market and company markets. Our ACII-qualified team has visited over 500 insurance firms across 50 countries, so we understand how controls work for both mainstream and niche products.

• Risk-based sampling that reflects your real book of business
• Thorough underwriting file review against the binder and guidelines
• Clear, actionable findings with reasoning behind every recommendation
• Reports delivered on time, supported by a six-year record of meeting deadlines

To see how this works in practice, explore our delegated authority audits or contact our team to discuss your next underwriting controls review.

Related Articles

• What information is needed before a coverholder audit begins?
• How are risk-based insurance audits different from standard audits?
• What happens after the fieldwork stage of a coverholder audit?
• How does an auditor select files for a delegated authority review?
• How can insurers tell whether an audit methodology is sufficiently thorough?