Auditors identify weaknesses in delegated underwriting by testing whether a coverholder, MGA or other delegated underwriter actually operates within the authority granted in the binding authority agreement. They compare written procedures against real underwriting files, check bordereaux against source records, and look for gaps between what the contract requires and what happens in practice.

The strongest findings come from evidence, not impressions. This article explains where auditors start, how they sample files, which red flags matter, and what happens once a weakness is rated and reported.

Which areas of delegated underwriting do auditors test first?

Auditors usually start with governance and authority limits. They confirm that the delegated underwriter understands its binding authority, including permitted classes, territories, limits of liability, rating rules and referral requirements, before testing whether those boundaries are respected in daily operations.

From there, a typical delegated authority audit moves through the areas that carry the most risk of leakage or breach:

• Authority limits, referral triggers and exclusions
• Underwriting guidelines, rating and pricing controls
• Sanctions, due diligence and licensing checks
• Documentation, wording control and policy issuance
• Bordereaux production and premium handling
• Complaints, conduct risk and Consumer Duty arrangements where relevant

Starting here matters because a weakness in authority control tends to explain problems found later in individual files.

How do auditors test underwriting files and sampling?

Auditors test underwriting files by selecting a sample of bound risks and tracing each one from submission to policy issue. They check that the risk fell within authority, was priced correctly, was referred where required, and that the file holds evidence of every decision taken.

Sampling is rarely random alone. A sound approach combines several selection methods so the sample reflects where problems are most likely to sit:

1. Select risks close to authority limits, where breaches are most probable.
2. Include referred risks and declined risks, not just bound business.
3. Cover each class, territory and underwriter named in the binding authority.
4. Add policies with unusual terms, endorsements or mid-term changes.
5. Extend the sample if early results show a pattern of errors.

For each file, the auditor asks a simple question: could a third party reconstruct why this risk was accepted on these terms? If the answer is no, that is a finding in its own right, even when the underwriting decision itself was reasonable.

What red flags signal weak underwriting controls?

The clearest red flags are inconsistency and missing evidence. When similar risks are priced differently without explanation, when referrals are not documented, or when files cannot show who approved a decision, the underlying control environment is probably weaker than the written procedures suggest.

Auditors pay particular attention to patterns such as:

• Business bound outside permitted classes, territories or limits
• Rating deviations with no recorded justification
• Reliance on one individual with no peer review or sign-off
• Outdated guidelines or wordings still in use
• Late or incomplete sanctions and due diligence checks
• Staff who cannot explain the binding authority terms they work under

One isolated error is usually a training point. A repeated error across the sample suggests a control that is either missing or not working.

How do auditors verify bordereaux and financial controls?

Auditors verify bordereaux by reconciling reported premium and risk data back to underlying policy records, cash receipts and accounting entries. The aim is to confirm that what the insurer receives is complete, accurate and timely, and that premium is collected, held and remitted as the agreement requires.

Bordereaux testing typically looks at whether risk and premium bordereaux match each other, whether figures tie to source documents, and whether submissions arrive within contractual deadlines. Auditors also review how premium is received, whether it is held in the correct client money or trust account, and how commission and deductions are calculated.

This is a compliance review of delegated authority controls, not a financial audit of accounts. The question is whether data and money flow correctly under the terms of the binding authority, which is a different discipline from statutory or internal audit.

How are audit weaknesses rated and reported?

Auditors rate weaknesses by considering the severity of the control failure and its potential impact on the insurer, policyholders and the delegated underwriter's compliance position. Most firms use a simple scale, such as high, medium and low, so that findings can be prioritised and tracked.

A well-written finding explains four things: what was found, why it matters, the evidence behind it, and what action is recommended. Clarity here is essential. A finding the reader cannot understand is a finding that will not be fixed.

Rating considers factors such as whether a breach is systemic or isolated, whether it has caused financial loss or customer detriment, and whether the delegated underwriter was already aware of it. Good reports also record strengths, so the insurer sees a balanced picture of the control environment. Timely delivery matters as well, because findings lose value if they reach the delegating insurer long after the visit.

What happens after an audit identifies weaknesses?

After an audit, the delegated underwriter responds to each finding with an agreed action, an owner and a target date. The insurer then monitors progress, often through follow-up reviews or evidence submissions, and decides whether the findings affect the continuation or terms of the binding authority.

The usual sequence looks like this:

• The report is shared with the delegated underwriter and the delegating insurer.
• Management agrees remedial actions and deadlines.
• Evidence of completion is reviewed, sometimes through a targeted follow-up audit.
• Serious or unresolved issues may lead to restricted authority, additional referral requirements or, in the most serious cases, termination.

Most findings are resolved through practical improvement rather than sanction. The purpose of delegated authority oversight is a stronger control environment, which protects both parties.

How Otter Audit helps with delegated underwriting audits

Otter Audit is a London-based specialist in delegated authority auditing, and its ACII-qualified team has visited over 500 insurance firms across 50 countries. For insurers overseeing coverholders and MGAs, that experience translates into audits that are technically grounded and easy to act on.

• Delegated underwriting, claims, pre-bind, run-off and complaints audits
• Clear findings that explain the issue, its significance and the reasoning behind each recommendation
• Reports delivered within agreed deadlines
• Experience across diverse and specialist insurance products

To see how this works in practice, explore our delegated authority audits, or contact the team to discuss your oversight programme.

Related Articles

• How should insurers prepare their intermediaries for an audit?
• What is a representative sample in an underwriting audit?
• What is the difference between a remote and an on-site coverholder audit?
• Can an insurance audit be completed entirely remotely?
• How do auditors conduct interviews with coverholder staff?