OTTER AUDIT / INSIGHTS

What happens after the fieldwork stage of a coverholder audit?

Posted by: Alex Jones
12 Nov 2026

After fieldwork ends, the auditor drafts a report, the coverholder reviews it for factual accuracy, and the report is finalised and issued to the insurer. Findings are then rated, the coverholder agrees an action plan, and progress is tracked until each action is closed. A follow-up audit may be required where significant issues remain.
The exact process varies between insurers and audit scopes, but the sequence is broadly consistent across the delegated authority market. The sections below answer the most common questions about each stage.

How is a coverholder audit report drafted and issued?

A coverholder audit report is drafted by the auditor from the evidence gathered during fieldwork, reviewed internally for quality, shared with the coverholder in draft, and then issued in final form to the contracting insurer. Most reports are expected within an agreed timeframe after the on-site or remote work finishes.
Drafting is more than writing up notes. The auditor tests each observation against the binding authority agreement, the relevant regulatory requirements and the evidence sampled, such as policy files, bordereaux, claims files and complaints records. Each finding should explain what was found, why it matters and what the auditor recommends.
A well-drafted report typically contains:

The scope and period covered by the delegated authority audit
An overall conclusion or opinion on the control environment
Individual findings, each with a rating and supporting evidence
Recommendations that link clearly to the finding they address
Examples of good practice, where observed

Timeliness matters here. Insurers rely on the report to make decisions about the coverholder's authority and capacity, so delays reduce its value. Clear writing matters just as much, because a report that cannot be understood quickly cannot be acted on quickly.

What happens during the factual accuracy review of an audit report?

The factual accuracy review is the stage where the coverholder reads the draft report and confirms that the facts stated are correct. It is not a negotiation of the findings. The coverholder can correct errors, supply missing evidence or clarify misunderstandings, and the auditor decides whether any changes to the report are warranted.
In practice, the draft is sent to a named contact at the coverholder, usually with a short deadline for comment. Typical corrections include a wrong policy count, a misread date or a document that existed but was not provided during fieldwork.
The review works best when both sides stay disciplined about its purpose:

The coverholder checks each statement of fact against its own records.
Any disagreement is raised in writing, with supporting evidence attached.
The auditor reviews the evidence and amends the report where the facts support it.
Where the auditor maintains a finding, the reasoning is recorded.
The final report is issued to the insurer, usually alongside the coverholder's responses.

A finding rests on the evidence available at the time of the audit. Evidence produced afterwards may show a control has since been put in place, but that is normally handled through the action plan rather than by removing the finding.

How are findings rated and what do the ratings mean?

Findings are rated by severity, so the coverholder and insurer can see which issues need urgent attention. Most schemes use three or four levels, commonly some version of high, medium and low, reflecting the risk to the insurer, policyholders or regulatory standing. Rating scales differ between insurers, so the report should define its own.
A typical scale works like this:

High (or critical): a serious control failure, regulatory breach or contractual breach that needs immediate action.
Medium: a control weakness that could lead to a breach or loss if left unaddressed, requiring action within an agreed period.
Low: a minor weakness or an opportunity to improve, addressed as part of business as usual.

Ratings reflect both the likelihood of harm and its potential impact. A single missed sanctions check on a high-risk risk may carry more weight than several minor documentation gaps. Auditors also consider whether an issue is isolated or systemic, which is why sample size and the pattern across files matter.
Some insurers, including those in the Lloyd's market, apply their own rating frameworks and reporting templates. A coverholder working with several carriers may therefore see the same issue rated differently in different reports.

What should a coverholder do with audit recommendations?

A coverholder should convert each recommendation into a specific, owned and time-bound action, then agree that plan with the insurer. Recommendations are not suggestions to consider at leisure. They are the route to closing the gap the auditor identified, and insurers expect a credible response.
A strong audit action plan states, for each finding:

What will be done, in concrete terms
Who is responsible, by name or role
The target completion date
What evidence will show the action is complete

Root cause is worth considering before choosing the fix. If bordereaux are late, the answer may be a process or resourcing change rather than a reminder email. Fixing symptoms often leads to the same finding recurring at the next audit.
Where a coverholder disagrees with a recommendation, the better route is to propose an alternative control that addresses the same risk and explain why it is suitable. Insurers are generally open to this when the reasoning is sound and documented.

How are audit actions tracked until they are closed?

Audit actions are tracked through an action log owned jointly by the coverholder and the insurer's delegated authority team. Each action is monitored against its due date, the coverholder submits evidence of completion, and the insurer confirms closure only once that evidence is satisfactory. Overdue actions are usually escalated.
The tracking process normally follows these steps:

The agreed actions are logged with owners, dates and ratings.
The coverholder updates progress at agreed intervals.
Evidence is submitted, such as an updated procedure, training record or sample of corrected files.
The insurer or auditor reviews the evidence and either closes the action or asks for more.
Remaining open actions are reported through the insurer's delegated authority oversight governance.

Closure should depend on evidence, not assurance. A statement that a process has been updated is not the same as a document showing it has been updated and is working. Higher-rated actions generally receive tighter deadlines and closer scrutiny.

When is a follow-up audit required after a coverholder audit?

A follow-up audit is required when the original audit identified serious or numerous issues that cannot be verified as resolved through evidence alone. Insurers commonly commission one where high-rated findings exist, where actions have been repeatedly missed, or where the coverholder's authority is conditional on demonstrated improvement.
Follow-ups are usually narrower than the original audit. They concentrate on the areas that produced significant findings, such as claims handling or premium and bordereaux processes, and test whether the new controls operate in practice.
Common triggers include:

One or more high-rated findings
Failure to close actions by the agreed dates
Significant changes at the coverholder, such as new systems, new management or a change of ownership
Concerns raised through complaints, claims experience or regulatory attention

Where an audit is clean or findings are minor, the insurer may rely on desk-based evidence review and wait for the next scheduled audit cycle. The decision rests with the insurer, informed by the auditor's report.

How Otter Audit helps with coverholder audit reporting and follow-up

The period after fieldwork is where an audit delivers its value, and it depends on clear reporting and disciplined follow-through. Otter Audit supports insurers and coverholders at every stage of this process:

Reports are drafted by ACII-qualified Chartered Insurers with direct delegated authority experience
Findings are written plainly, with the reasoning behind each rating and recommendation explained
Reports are delivered within agreed deadlines, backed by a six-year record of on-time delivery
Follow-up reviews can be scoped to the areas that matter most

The team has visited over 500 insurance firms across 50 countries, so it understands how specialist and non-standard products affect what good controls look like. To discuss an upcoming audit or get help with an outstanding action plan, contact the Otter Audit team.

Otter Audit