A thorough audit methodology defines its scope in writing, selects file samples using a documented and risk-based rationale, supports every finding with evidence, and reports in a way that explains significance and recommended actions. Insurers can verify this by asking for the methodology before the audit starts and testing it against these criteria.
The right level of thoroughness also depends on the delegated authority arrangement being reviewed, whether that is a coverholder, an MGA or a claims administrator. The sections below set out the questions to ask and the signals to look for.
What does a thorough audit scope actually cover?
A thorough delegated authority audit scope covers every function the insurer has delegated, tested against the binding authority or service agreement and the relevant regulatory requirements. It should be agreed in writing before fieldwork begins, so both the insurer and the auditor know exactly what is, and is not, being reviewed.
For a typical coverholder or MGA, that means looking beyond underwriting alone. A methodology that tests only a handful of policies against the rating guidelines is a file review, not a full audit.
Look for coverage of the following areas:
- Underwriting authority, including limits, prohibited risks and referral processes
- Premium handling, bordereaux accuracy and timeliness of reporting
- Claims authority and handling, where delegated
- Complaints handling and conduct risk, including Consumer Duty where relevant
- Governance, systems, data security and business continuity
- Sanctions, financial crime and licensing obligations across the territories involved
The scope should also be proportionate. A small intermediary writing one niche class does not need the same programme as a multi-territory MGA, but the reasoning for any exclusions should be documented.
How should auditors select and size their file samples?
Auditors should select file samples using a documented, risk-based approach rather than relying on whatever the audited firm chooses to provide. Sample sizes should reflect the volume of business, the complexity of the class and any known risk indicators, and the auditor should be able to explain how the sample was drawn and why it is sufficient.
Independence is the key test. If the coverholder picks the files, the audit has already lost much of its value. Auditors should draw samples from the full bordereaux or claims listing, ideally on the day of the audit or shortly before it.
A well-constructed sample typically includes:
- Files selected at random from across the full period under review
- Targeted files chosen for risk, such as high-value policies, referrals, declined risks and large or contentious claims
- Additional files selected after fieldwork begins if early results suggest a problem area
That last point matters. If the auditor discovers weaknesses in the first few files, a thorough methodology allows the sample to be extended rather than simply noting the issue and moving on. Ask how the auditor handles this, and whether there are set thresholds that trigger wider testing.
How can insurers tell if findings are evidence-based?
Findings are evidence-based when each one can be traced to specific documents, files or system records, measured against a stated requirement. If a finding cannot be linked to a file reference, a contract clause or a regulatory obligation, it is an opinion and should be treated with caution.
Strong audit evidence has a clear chain. The auditor identifies the requirement, tests it against what actually happened, records what they saw and explains the gap. For example, rather than reporting that "referral processes are weak", an evidence-based finding states how many sampled risks exceeded the authority limit, which clause was breached and whether the referral was recorded.
Insurers can test this by asking auditors to show how evidence is captured and retained. Good practice includes working papers that record what was reviewed, the date and the reviewer, and a clear distinction between confirmed facts and matters still to be verified.
Interviews and walkthroughs have a place, but they should corroborate documentary evidence, not replace it. Where an audited firm describes a control, a thorough auditor tests that the control operates in practice.
What should a high-quality audit report include?
A high-quality audit report states the scope and sample, summarises overall control standards, and presents each finding with its evidence, significance and a recommended action. It should be clear enough for a Delegated Authority Manager to act on without needing to follow up for clarification.
Look for these features:
- A clear executive summary and an overall rating, with the criteria behind it explained
- Findings ranked by severity, so the most urgent issues stand out
- The reasoning behind each recommendation, not just the instruction
- Recognition of good practice, which shows the auditor has assessed fairly
- Agreed management responses and target dates for remediation
Timeliness is part of quality. A report delivered months after fieldwork loses much of its value, because the control environment may have changed and regulatory or contractual deadlines may have passed. Agree a delivery timeframe up front and check the auditor's track record against it.
Clarity of writing matters too. Findings that are vague, over-technical or buried in lengthy narrative make it harder for the audited firm to fix problems and for the insurer to track them.
Which auditor qualifications and experience signal real depth?
Real depth shows in relevant insurance qualifications, such as ACII status, combined with direct experience of the delegated authority market and the specific class of business being audited. Ask who will actually perform the fieldwork, not just who leads the engagement, and what similar arrangements they have reviewed.
Delegated authority auditing is a distinct discipline. It differs from financial auditing, which focuses on statements and accounts, and from internal audit, which reviews an organisation's own processes. An auditor with a general audit background may not recognise a binder breach or a bordereaux anomaly.
Useful questions to ask include:
- Has the team audited this product type and territory before?
- How do auditors share knowledge and keep up with regulatory change?
- Is there internal review or training to keep findings consistent between auditors?
- Do the auditors understand niche or non-standard risks, or only mainstream lines?
Experience across different jurisdictions is a further signal. Regulatory expectations vary between the UK, Europe and North America, and an auditor who has worked in each is better placed to judge whether controls are appropriate for the territory concerned.
How do insurers test a methodology before relying on it?
Insurers can test a methodology by requesting the audit programme and a sample report in advance, comparing them against their own oversight requirements, and running a pilot or a small initial engagement. Reference checks and a review of the first report against known issues also show whether the approach holds up.
A practical approach is to work through these steps:
- Request the audit scope, programme and sample selection method before appointing the auditor.
- Review a redacted sample report for clarity, evidence and actionability.
- Check that the methodology maps to the insurer's own contractual and regulatory obligations.
- Begin with a lower-risk or well-understood coverholder, so results can be compared with what you already know.
- After the first engagement, review whether findings were accurate, delivered on time and useful for remediation.
If an auditor is reluctant to explain how they work, that is itself informative. A confident methodology can withstand scrutiny, and the best auditors welcome these questions.
How Otter Audit helps with delegated authority audit thoroughness
Otter Audit is a London-based specialist in delegated authority auditing, working with over 60 insurers and having visited more than 500 firms across 50 countries. Its delegated authority audits are designed to meet the standards described above.
- ACII-qualified Chartered Insurers perform the fieldwork, backed by over 80 years of combined partner experience
- Scope, sampling and evidence requirements are agreed before fieldwork begins
- Reports explain each finding, its significance and the reasoning behind every recommendation
- Delivery against agreed deadlines has been maintained across a six-year track record
- Coverage includes underwriting, claims, run-off, pre-bind and complaints audits
To discuss how your oversight programme could be tested and strengthened, get in touch with the Otter Audit team.