An on-site delegated authority audit is necessary when risk indicators, regulatory expectations or the complexity of the delegated arrangement mean a desktop review cannot give sufficient assurance. Typical triggers include poor desktop results, rapid premium growth, adverse claims experience and the onboarding of a new coverholder or MGA.
Desktop reviews have a valid place in oversight, but they rely on what the delegate chooses to send. Seeing systems, people and files firsthand is the only reliable way to test whether documented controls operate in practice. The sections below cover the triggers, the added value of a visit, regulatory expectations, frequency and preparation.

What risk triggers justify an on-site audit visit?

An on-site audit is justified when risk signals suggest that documents alone will not reveal the true control environment. Common triggers include a new delegated arrangement, material changes in business volume, deteriorating performance, unresolved prior audit findings and unexplained gaps in management information.
The following events should prompt a visit:

• New delegations: a newly appointed coverholder or MGA with no track record under your authority.
• Rapid growth: premium or policy count rising faster than the delegate's staffing and systems.
• Adverse results: loss ratios, claims leakage or complaint volumes moving outside expected ranges.
• Business changes: new products, new territories, a change of ownership, key staff departures or a system migration.
• Weak earlier audits: repeated or overdue findings from previous reviews.
• Reporting concerns: late, inconsistent or unreconciled bordereaux.

A single trigger may be manageable through a targeted desktop request. Several triggers appearing together usually make the case for a visit clear.

What can an on-site audit reveal that a desktop review cannot?

An on-site audit reveals how controls actually operate day to day, not how they are described in manuals. Auditors can observe live processes, test systems, interview staff and select files at random, exposing gaps between written procedures and real behaviour that a desktop review is unlikely to detect.
Consider a coverholder whose underwriting guidelines look robust on paper. On site, the auditor may find that referrals to the insurer are being logged after the risk has been bound, or that underwriters are working around system limits with spreadsheets. Neither issue would appear in a policy document sent by email.
A visit also allows auditors to:

• Assess the competence and awareness of staff by speaking with them directly.
• Test system access, segregation of duties and data security in practice.
• Select files independently, rather than reviewing a sample the delegate has curated.
• Judge the culture around conduct, complaints handling and fair treatment of customers.

Desktop reviews remain efficient for lower-risk arrangements, document checks and follow-up on closed findings. The two methods work best as complementary parts of one oversight programme.

Do regulators or Lloyd's require on-site audits?

Neither regulators nor Lloyd's generally prescribe on-site visits for every arrangement, but both expect meaningful, risk-based oversight of delegated authorities. Where Lloyd's coverholders are concerned, managing agents are expected to audit and monitor coverholders appropriately, and a physical visit is often the proportionate way to evidence that.
Lloyd's requirements around coverholder approval and ongoing monitoring have historically placed particular weight on a managing agent's pre-bind or early review of a new coverholder and regular reviews thereafter. Requirements and guidance change over time, so always check the current Lloyd's Delegated Authority requirements and your own regulator's rules, such as the FCA and PRA expectations on outsourcing and third-party oversight in the UK, rather than relying on a general summary.
The practical point is this: regulators and market bodies look for evidence that oversight was proportionate to risk. If a high-risk arrangement was reviewed only from a distance, the insurer may struggle to justify that choice.

How often should a delegated authority be audited on-site?

There is no single correct frequency. On-site audit frequency should follow the risk profile of each delegated authority, with higher-risk arrangements visited more often. Many insurers adopt a risk-based cycle, with an early review of new arrangements and longer intervals for stable, well-performing delegates.
A simple way to set the cycle is to follow these steps:

1. Risk-rate each delegate using premium volume, class of business, claims authority, geography and past audit results.
2. Set a baseline visit interval for each rating band, with the shortest cycle for the highest-risk band.
3. Add an early review shortly after a new delegation begins.
4. Allow for event-driven visits when a trigger such as adverse results or a change of control occurs.
5. Review the schedule regularly and adjust ratings as new information arrives.

Document the reasoning behind each decision. A clear, consistent audit frequency policy is easier to defend than ad hoc scheduling.

How should an on-site audit be scoped and prepared?

An on-site audit should be scoped around the specific risks of the delegated authority and prepared well in advance. Agree objectives, review the contract and prior findings, request key documents before travelling, and plan the file sample, interviews and timetable so the time on site is used to test controls.
Good preparation usually covers:

• Authority and contract review: confirm the binding authority limits, reporting duties and audit rights.
• Prior findings: check what was raised before and whether it was closed.
• Pre-visit data: request bordereaux, claims listings and complaints logs so sampling can be risk-targeted.
• Scope by function: underwriting, claims, complaints, financial controls and data protection, weighted to risk.
• Logistics: confirm attendees, system access and a clear agenda with the delegate.

Equally important is the output. A useful report explains each finding, why it matters and the reasoning behind each recommendation, and arrives within the agreed deadline so the insurer can act while the visit is still fresh.

How Otter Audit helps with on-site delegated authority audits

Otter Audit provides independent delegated authority audits carried out by ACII-qualified Chartered Insurers, with experience across more than 500 insurance firms in 50 countries. Their approach is built around risk, practical insight and clear reporting.
Otter Audit can support you by:

• Scoping on-site visits around your specific risk triggers and class of business.
• Auditing delegated underwriting, claims, complaints, run-off and pre-bind arrangements.
• Delivering clear findings with explained recommendations, on time.
• Advising on a risk-based frequency for your coverholders and MGAs.

Explore the full range of delegated authority audits, or contact the team to discuss your next on-site visit.

Related Articles

• How are risk-based insurance audits different from standard audits?
• How do auditors decide which underwriting files to review?
• How does an auditor select files for a delegated authority review?
• How do auditors identify weaknesses in delegated underwriting processes?
• How can insurers tell whether an audit methodology is sufficiently thorough?