When audit evidence is incomplete or inconsistent, the auditor cannot conclude that a control is operating effectively, so the gap is documented, challenged and, where it cannot be resolved, reported as a finding. In a delegated authority audit, missing or conflicting evidence directly affects the audit rating and the remediation required.

The outcome depends on how material the gap is and whether the coverholder can explain it. The sections below cover the causes, the auditor's response, reconciliation, findings, ratings and the practical steps a coverholder can take to close evidence gaps.

What causes gaps and conflicts in audit evidence?

Gaps and conflicts in audit evidence usually arise from weak record keeping, fragmented systems or inconsistent processes at the coverholder. Documents may be missing, stored in different places, or contradicted by other sources such as bordereaux, system data or staff explanations.

Common causes include:

• Underwriting decisions made by phone or email and never recorded on the policy file
• Multiple systems holding different versions of the same data, such as a policy administration platform and a spreadsheet
• Staff turnover, where the person who understood a process has left without a handover
• Manual processes that rely on individual habits rather than documented procedures
• Outsourced functions where records sit with a third party the coverholder cannot readily access

A realistic example is a coverholder whose referral log shows a risk was referred to the insurer, but the underwriting file contains no referral email. Either the referral happened and was not retained, or it never happened. The evidence alone cannot say which.

How do auditors respond to incomplete evidence during fieldwork?

Auditors respond by asking for the missing evidence, testing alternative sources and documenting what could and could not be verified. The aim is to establish whether a control exists and operates, not to penalise a filing error. Fieldwork is the coverholder's best opportunity to resolve gaps before conclusions are drawn.

In practice, an auditor will typically work through these steps:

1. Request the missing document directly and allow reasonable time for it to be located
2. Look for corroborating evidence elsewhere, such as system audit trails, emails, bordereaux or insurer records
3. Interview the relevant staff to understand how the process works in practice
4. Extend the sample if the gap suggests a wider problem rather than an isolated lapse
5. Record clearly what was seen, what was not, and why it matters

Verbal explanations are useful context but are rarely sufficient on their own. A control that cannot be evidenced is difficult to rate as effective, however confidently it is described.

How should conflicting audit evidence be reconciled?

Conflicting evidence should be reconciled by identifying which source is most reliable, establishing why the sources differ, and confirming the explanation with independent proof. Auditors generally give more weight to system-generated and third-party records than to documents created after the event or to unsupported statements.

Reconciliation usually involves comparing the conflicting items against a third source. If a policy schedule shows one premium and the bordereau shows another, the auditor traces both back to the rating record, the cash receipt or the insurer's own data. Timing differences, version control issues and data entry errors are common explanations, and each has different implications.

If the conflict cannot be explained, it is not ignored. An unresolved inconsistency is itself evidence of a weakness in data integrity or record keeping, and it is reported on that basis. This matters because delegated authority oversight depends on insurers being able to rely on the data they receive.

Does missing evidence count as a finding?

Yes, missing evidence can count as a finding, but not automatically. If a required control or record cannot be evidenced after a reasonable opportunity to produce it, auditors typically treat it as not demonstrated. Whether it becomes a formal finding, and how serious it is, depends on materiality and whether alternative evidence exists.

Several factors shape the decision:

• Requirement: whether the record is mandated by the binding authority agreement, the insurer's standards or regulation
• Frequency: whether the gap is a single instance or a pattern across the sample
• Impact: whether the missing item relates to a high-risk area such as authority limits, sanctions screening or claims reserving
• Cause: whether the control failed or only the record keeping did

An isolated missing document with strong corroborating evidence may be an observation or minor finding. The same gap repeated across a sample, or affecting a critical control, is likely to be a significant finding.

How does incomplete evidence affect audit ratings and reports?

Incomplete evidence typically lowers audit ratings because the auditor can only give credit for controls that are demonstrated. Where evidence is insufficient, the report may record a limitation of scope, rate the affected area less favourably, or recommend a follow-up review once the gaps are addressed.

A well-written report separates two distinct situations. In the first, the control failed. In the second, the control may exist but could not be verified. Both can reduce a rating, but they lead to different remediation. Clear reports explain which applies and the reasoning behind it, so the coverholder and the insurer understand what action is needed and why.

Insurers reading the report use it to decide how much confidence to place in the coverholder's oversight arrangements. Evidence limitations can therefore influence capacity decisions, the frequency of future audits and the level of monitoring applied between them.

What should a coverholder do to close evidence gaps?

A coverholder should respond promptly with the missing evidence where it exists, explain gaps honestly where it does not, and put a documented remediation plan in place. Closing evidence gaps is about improving the control environment, not retrospectively manufacturing records, which damages credibility.

Practical actions include:

• Supplying missing documents within the agreed timeframe, with context on where they were found
• Confirming in writing any decision that was made verbally, clearly dated as a later record
• Agreeing a central, consistent location for key records such as referrals, authority approvals and complaints
• Assigning owners and deadlines to each remediation action
• Preparing for the follow-up audit by testing the fixed controls internally first

Good evidence habits also help in routine oversight. Keeping contemporaneous records, reconciling data between systems and documenting processes make every future audit faster and less contentious.

How Otter Audit helps with incomplete or inconsistent audit evidence

Otter Audit is a specialist delegated authority audit firm, and our ACII-qualified auditors deal with evidence gaps and inconsistencies regularly across coverholders, MGAs and intermediaries in many territories. We aim to make findings clear, proportionate and actionable.

• Explaining precisely what evidence is required before fieldwork begins, so gaps are avoided
• Distinguishing between failed controls and controls that could not be verified
• Producing clear reports that set out the significance of each finding and the reasoning behind recommendations
• Delivering reports within agreed deadlines
• Supporting remediation and follow-up reviews once actions are complete

To understand how we approach evidence in practice, explore our delegated authority audits, or contact our team to discuss an upcoming audit.

Related Articles

• How should insurers prepare their intermediaries for an audit?
• When is an on-site delegated authority audit necessary?
• What is the difference between a remote and an on-site coverholder audit?
• How does an auditor select files for a delegated authority review?
• How do auditors conduct interviews with coverholder staff?