Claims is the insurer’s product delivered. Everything else the company does (pricing, underwriting, investing, distribution) exists so that when a policyholder’s car is wrecked, house burns or employee is injured, an adjuster evaluates the loss and pays what the policy promises, no more and no less, quickly and in compliance with the law of whichever state the claimant lives in. The process spends most of the premium (loss and loss adjustment expense typically consume 60 to 80 cents of every premium dollar at a property and casualty insurer), it sets the case reserves that drive the balance sheet, it is the part of the company regulators examine most closely for consumer harm, and it is the main entry point for fraud against the insurer. An audit of claims is therefore an audit of money, of compliance and of the promise, and it is the engagement an insurance internal audit function should get right before any other.
This guide explains how to audit the claims process from first notice of loss to settlement: why claims is the core process and what goes wrong, the regulatory frame, the control points, coverage verification, case reserving, adjuster authority and payment controls, vendors and third-party administrators, litigation management, catastrophe claims, fraud touchpoints, the leakage analytics, a test-by-test program, a worked engagement at Caldera Mutual Insurance Group, the failures that recur, and how to report. It extends the internal audit in insurance pillar, which places claims among the insurer’s other audit entities.
In this guide
- Why claims is the core process and what goes wrong
- The regulatory frame
- Control points from first notice to closure
- Intake and coverage verification
- Case reserving and the link to the actuaries
- Adjuster authority and payment controls
- Vendors, independent adjusters and third-party administrators
- Litigation management
- Catastrophe claims
- Fraud touchpoints
- Leakage analytics
- A test-by-test program
- A worked engagement: Caldera Mutual’s FY26 claims audit
- Failures that recur
- Reporting claims findings
- Questions about auditing claims
- Related guides
Why claims is the core process and what goes wrong
Four things make claims the highest-stakes process at an insurer. Money: adjusters have authority to pay, and the cumulative effect of small overpayments (an inflated repair estimate accepted, a duplicate medical bill paid, a subrogation opportunity missed, a salvage recovery lost) is the industry’s “leakage,” commonly estimated at several percent of indemnity paid, which at a company paying a billion dollars a year is tens of millions. Reserves: the case reserve an adjuster sets on each open claim is the starting point for the loss reserves that are the largest liability on the balance sheet, and systematic under-reserving at claim level (reserves set low and raised in steps as the claim develops, the “stair-stepping” pattern) misstates earnings and misleads the actuaries whose incurred-but-not-reported estimates depend on case reserve adequacy being stable. Compliance: every state regulates how claims are handled (acknowledgment, investigation, decision and payment deadlines, denial letter content, documentation), market conduct examiners test claim files against those standards, and the penalties for a pattern of violations include fines, restitution and consent orders, while individual mishandling produces bad-faith litigation with damages far above policy limits. Fraud: the Coalition Against Insurance Fraud’s 2022 study estimated insurance fraud costs in the United States at about $308.6 billion a year across all lines, and most of it enters through claims (staged accidents, inflated or fictitious losses, provider billing rings, contractor fraud after storms, claimant misrepresentation in workers’ compensation), with insider fraud by adjusters and vendors as the costliest single-case category. What goes wrong is rarely dramatic in any one file. It is the accumulation: untrained adjusters under caseload pressure, authority limits circumvented by split payments, reserves managed to a target, vendors unmonitored, fraud indicators unreferred, deadlines missed in a state whose standard the adjuster did not know. The audit’s job is to measure the accumulation.
The regulatory frame
| Regime | What it requires of claims | Internal audit’s angle |
|---|---|---|
| Unfair claims settlement practices laws (state versions of the NAIC Unfair Claims Settlement Practices Act, Model 900, and the related model regulation) | Prompt acknowledgment and investigation; timely acceptance or denial after proof of loss (the deadlines vary by state, commonly 15 to 45 days, with status letters when more time is needed); fair settlement without compelling litigation; written denials citing policy provisions; no misrepresentation of policy terms; documentation of the file; a pattern of violations is the test for enforcement | Timeliness testing by state against each state’s standards; denial letter quality; file documentation |
| Market conduct examinations (NAIC Market Regulation Handbook standards; state examiners) | Claim handling tested for timeliness, proper handling, documentation, correct payment amounts, denial accuracy and complaint handling; data calls and targeted exams | Mirror the handbook’s claim standards in the audit program; examination readiness |
| Anti-fraud and special investigations unit requirements (state statutes and regulations, with mandatory anti-fraud plans, SIUs, referral to fraud bureaus and training in many states) | A fraud plan filed where required; an SIU with defined referral criteria; reporting of suspected fraud to state fraud bureaus; adjuster training; immunity provisions for good-faith reporting | Referral criteria applied; SIU capacity and outcomes; reporting compliance; training completion |
| Medicare Secondary Payer reporting (Section 111; liability, no-fault and workers’ compensation) | Quarterly reporting of settlements, judgments and ongoing responsibility for medicals involving Medicare beneficiaries; conditional payment resolution; civil money penalties for late reporting under the 2023 rule | Identification of Medicare beneficiaries; reporting timeliness and accuracy; conditional payment handling |
| Total loss, salvage and title laws (state) | Total loss thresholds and valuation methods; salvage title processing; disclosure to owners | Valuation documentation; title and salvage handling |
| Life insurance: unclaimed property and death master file matching (state versions of the Unclaimed Life Insurance Benefits Act and the regulatory settlements since 2011) | Periodic matching of in-force policies against the death master file; outreach to beneficiaries; escheatment of unclaimed benefits; contestability (two years) and interest on delayed payments | Matching frequency and follow-up; escheat compliance; contestable claim handling |
| Health and workers’ compensation specifics (prompt-pay laws, utilization review rules, fee schedules, medical bill review, the No Surprises Act for health plans) | Payment deadlines with interest penalties; medical necessity review standards; correct application of fee schedules | Prompt-pay compliance; bill review accuracy; UR process compliance |
| Privacy and data protection (state insurance privacy laws, GLBA, HIPAA for health information, the NAIC data security model) | Protection of claimant medical and financial data; breach notification | Claims system access; vendor data handling; the data privacy program |
| Licensing of adjusters (state resident and non-resident licenses; emergency adjuster licensing after declared catastrophes) | Adjusters licensed where required, including temporary catastrophe adjusters | License verification for staff, independents and catastrophe surge teams |
| Financial reporting (statutory Schedule P development, Statement of Actuarial Opinion, GAAP and IFRS 17 or LDTI where applicable) | Case reserves and payment data feeding the actuarial estimates and the annual statement accurately | Case reserve adequacy and consistency; data integrity to the actuarial triangles |
Control points from first notice to closure
A claim passes through a sequence that is the same across lines with different vocabulary. First notice of loss: the claim is reported (phone, app, agent, attorney), a claim file opened with the loss date, policy and facts, acknowledged within the state’s deadline, and triaged by severity and complexity to the right adjuster. Coverage verification: the policy was in force on the loss date, the loss falls within the coverage and outside the exclusions, limits and deductibles identified, and any reservation of rights issued where coverage is uncertain. Investigation: statements, scene and damage inspection (in person or by photo and estimating software), police and medical records, experts where needed, liability determination in third-party claims, fraud indicators checked. Reserving: an initial case reserve set at the probable ultimate cost and revised as facts develop, with changes explained. Evaluation and negotiation: damages quantified (repair estimates, medical bills reviewed against fee schedules and necessity, wage loss documented, general damages evaluated), settlement authority obtained for the amount, negotiation documented. Payment: payees verified, releases obtained, payments approved within authority, issued through controlled channels, with liens (medical providers, Medicare, child support) and deductibles handled. Recovery: subrogation against responsible third parties, salvage of total-loss property, reinsurance recoverables identified and billed. Closure and reopening: the file closed with documentation complete, reopened only with reason and authority. Governance sits over the sequence: claims policies and procedures by line and state, authority matrices, quality assurance file reviews, management reporting (cycle time, pending inventory, reserve changes, leakage, complaints), and the systems (the claims administration system, estimating platforms, bill review, payment, document management) that enforce or fail to enforce the controls. The audit walks files through the sequence and tests governance around it; the audit work program guide shows how to structure the document.
Intake and coverage verification
Coverage errors run both ways: paying claims the policy does not cover (a lapsed policy, an excluded cause, a vehicle not on the policy, a business pursuit under a homeowners form) and denying or underpaying covered claims (the compliance and bad-faith exposure). The audit tests that the adjuster confirmed the policy in force on the loss date from the policy system rather than the claimant’s card, identified the applicable form and endorsements, documented the coverage analysis for anything other than routine losses, issued reservation of rights letters where coverage was in question before investing in the claim, and applied deductibles and limits correctly (including stacking rules, sublimits and per-occurrence versus aggregate limits). Denials receive a separate test: the denial letter cites the specific policy provision, the facts supporting it, the state-required language and appeal rights, and the file shows the investigation that justified it; a sample of denials weighted to the lines and adjusters with high denial rates, and a review of complaints and reopened denials, tests both accuracy and fairness. Intake timeliness is tested against each state’s acknowledgment and contact standards, which requires the audit to know which state governs each file (the claimant’s state for most unfair claims practices purposes, with the policy’s state for others), a point the claims system should carry as data.
Case reserving and the link to the actuaries
Case reserves are the adjuster’s estimate of what the open claim will ultimately cost, indemnity and expense, and the actuaries’ reserve estimates for the company rely on them in two ways: directly, as the reported incurred losses in the development triangles, and indirectly, through the assumption that case reserving practice is stable over time (a change in adequacy, stronger or weaker, distorts every development factor). The controls are a reserving philosophy (probable ultimate cost, set within a defined period after enough facts are known, with formula reserves for small claims), reserve authority tiers, documentation of each change with the reason, supervisory review of large reserves and large changes, reporting of reserve changes shortly before payment (the stair-step signature) and of claims closing far above or below reserve, and periodic reserve adequacy studies that compare initial and ultimate values by line and adjuster. Internal audit tests reserve-setting on the file sample (was the initial reserve supportable on the facts known, was it revised when the facts changed, were changes documented and authorized), runs the analytics (initial-to-ultimate ratios on closed claims by line, adjuster and accident year; reserve changes within 30 days of payment; closed-above-reserve frequency; reserves unchanged for long periods on active files), and discusses the results with the actuarial function, because a finding that bodily injury reserves are systematically set 20 percent low at inception is a finding about the reserve estimate as well as about claims. The model risk guide covers the reserving and claim-triage models increasingly used in the process, and the insurance pillar the reserve audit as a separate engagement.
Adjuster authority and payment controls
Authority is tiered by adjuster level and claim type, for reserves and for payments, with supervisory approval above the tier and committee or senior review for large losses. The failure modes are splitting (two payments under authority instead of one above it), authority measured per payment rather than per claim, system settings that do not match the authority matrix, supervisors approving their own files, and authority not reduced for adjusters with quality problems. Payment controls add payee verification (the payee is the insured, claimant, provider or vendor on the file; address and bank changes controlled), duplicate payment prevention (same claim, same amount, same payee or invoice), segregation between the adjuster who evaluates and whoever maintains vendor and payee master data, releases and lien resolution before payment, controlled issuance (checks and electronic payments from the claims payment system, not manual), and reconciliation of claims payments to the general ledger and the bank. The audit tests the system’s enforcement of authority (configuration against the matrix; override logs), runs the split-payment and duplicate analytics across all payments in the period, tests payee verification on a sample and runs the payee anomaly analytics (payments to employees’ addresses or bank accounts, payees shared across unrelated claims, vendors created and paid by the same adjuster, post-office box payees, round-dollar patterns), and tests the reconciliation. The accounts payable analytics guide’s tests transfer almost unchanged, and the segregation of duties and IAM guides cover the access side: who can create payees, change authority tables and issue payments in the claims system.
Vendors, independent adjusters and third-party administrators
Claims depend on vendors: independent adjusters and appraisers, direct repair program body shops, contractor networks, medical bill review and utilization review firms, independent medical examiners, defense counsel, estimating and valuation platforms, salvage auctions, and for some books third-party administrators who handle claims end to end. Each spends the insurer’s money or determines how much is spent, and each is a fraud and quality exposure. The controls are selection and onboarding (licensing, insurance, background checks, conflicts), contracts with service standards and billing rules, authority limits for vendors, invoice and estimate review (re-inspection programs for repair estimates, bill review audits), performance monitoring (cycle time, cost per claim, supplement rates, customer complaints, reopen rates), and for TPAs a full oversight program (claims handling audits by the insurer, reserve and payment authority, data access, reporting, bank account controls for the funds they disburse). Internal audit tests the oversight program against the third-party risk management guide’s structure and the due diligence by tier guide’s depth, tests vendor invoices and estimates in the file sample, runs analytics on vendor concentration by adjuster (an adjuster who steers 70 percent of repairs to one shop) and on supplement and re-inspection results, and audits TPAs directly where the insurer’s own program has not. Catastrophe vendors (independent adjusting firms deploying hundreds of adjusters) need the same controls under conditions that make them hardest to apply.
Litigation management
Litigated claims are the expensive tail: defense costs, verdicts and settlements that have grown faster than inflation in liability lines over the past decade (the industry calls it social inflation, and the drivers debated include litigation funding, attorney advertising and jury attitudes). The controls are early identification of claims likely to be litigated, panel counsel selection and rates, litigation budgets and plans, billing guidelines and invoice review (block billing, staffing, rates, expenses), reserve setting for defense costs separately from indemnity, settlement authority and evaluation discipline (round-table reviews of large exposures), excess carrier and reinsurer notification where limits are threatened, and reporting of litigation inventory, cycle time and outcomes against reserves. Internal audit tests the panel counsel program, samples litigated files for plan, budget and authority compliance, tests invoice review against the billing guidelines (and the use of e-billing tools), compares reserves to outcomes on closed litigated claims, tests excess and reinsurance notifications, and reviews the handling of claims that produced bad-faith allegations or extra-contractual payments, which are the clearest evidence of process failure. The procurement fraud schemes guide’s billing schemes apply to legal invoices as to any other vendor.
Catastrophe claims
A hurricane, hailstorm, wildfire or freeze produces in weeks the claim volume of a normal year, handled by surge staff (redeployed employees, independent adjusters, emergency-licensed adjusters) under regulatory attention and public scrutiny, and the controls that hold in normal operation bend. The specific risks are licensing lapses (adjusters working in states where they are not licensed or whose emergency licenses have expired), authority granted broadly to clear inventory, estimates accepted without inspection, contractor fraud (assignment-of-benefits abuse, inflated roof claims, unlicensed contractors soliciting policyholders), duplicate claims across policies, reserve adequacy set by formula on claims that do not fit the formula, and timeliness standards missed en masse with the state watching. The audit of a catastrophe event, performed after the fact or during it for the largest events, tests licensing for the surge roster, authority changes and their reversal, quality review coverage of surge adjusters’ files, contractor and vendor controls, duplicate and fraud analytics on the event population, reserve adequacy on the event, regulatory reporting and complaint handling, and the lessons-learned process; the reinsurance recoverable on the event (correct attachment, correct allocation of claims to the event, timely billing) is a financial test that often finds money.
Fraud touchpoints
Claims fraud divides into external (claimants, providers, contractors, organized rings) and internal (adjusters and vendors stealing from the insurer), and the controls differ. External fraud is addressed by indicator screening at intake and during handling (red flags such as losses shortly after inception or before lapse, inconsistent statements, prior claims history, provider patterns, staged-accident signatures), fraud scoring models and link analysis, referral criteria to the special investigations unit, SIU investigation and outcomes (denial, reduction, referral to fraud bureaus and prosecutors), and adjuster training. Internal fraud is addressed by the payment and payee controls above, access controls, vendor steering monitoring, and analytics on adjuster behavior (payments to new payees, payments just under authority, reopened claims with payments, claims with no claimant contact, address matches). Internal audit tests the referral process (are indicator-flagged claims referred at the rate the criteria imply, or are adjusters closing them for speed?), the SIU’s capacity and results, the fraud model’s governance, the training, the mandatory reporting to state fraud bureaus, and runs the internal fraud analytics itself; the fraud risk assessment guide gives the method, the ACFE fraud tree the taxonomy, the fraud red flags guide the indicators, and the first 48 hours guide what to do when the analytics find an adjuster paying a vendor at his own address.
Leakage analytics
| Analytic | Computation | What it finds |
|---|---|---|
| Timeliness by state | Days from report to acknowledgment, to contact, to decision, to payment, against each governing state’s standard | Compliance failures concentrated by state, adjuster or line |
| Split payments | Multiple payments on one claim to one payee within a short window whose sum exceeds the adjuster’s authority | Authority circumvention |
| Duplicate payments | Same claim, payee and amount; same invoice number; same medical bill across claims | Overpayment and provider double-billing |
| Payee anomalies | Payee addresses or bank accounts matching employees; payees shared across unrelated claims; vendors created and paid by one adjuster; PO boxes | Internal fraud indicators |
| Reserve stair-stepping | Reserve increases within 30 days of payment; initial-to-ultimate ratios by adjuster and line | Reserve inadequacy and management to targets |
| Closed above reserve | Claims closing at more than a threshold above the reserve held 90 days before closing | Reserving quality |
| Subrogation and salvage misses | Claims with liability indicators (third party at fault, product defect) and no subrogation referral; total losses with no salvage recovery recorded; recoveries unmatched to claims | Recovery leakage |
| Vendor steering | Share of an adjuster’s repairs, inspections or referrals to one vendor versus peers | Conflicts and kickbacks |
| Supplement and re-inspection rates | Supplemental estimates per claim by shop; re-inspection variance by estimator | Estimate inflation |
| Reopen patterns | Claims reopened with payment shortly after closure; reopens by adjuster | Fraud and quality |
| Litigation reserves versus outcomes | Indemnity and expense outcomes against reserves on closed litigated claims | Evaluation and reserving quality on the tail |
| Fraud referral yield | Indicator-flagged claims referred ÷ flagged; SIU savings ÷ referrals | Under-referral or an SIU that cannot keep up |
A test-by-test program
| Area | Test | Evidence |
|---|---|---|
| Governance | Claims policies and procedures current by line and state; authority matrix approved and configured in the system; quality assurance program coverage and results; management reporting completeness | Policies, system configuration, QA reports, dashboards reconciled to data |
| Intake and coverage | Sample files: acknowledgment and contact within state standards; policy in force confirmed; coverage analysis documented; reservation of rights where needed; deductibles and limits applied | Claim files, policy system, letters |
| Investigation | Statements, inspections and records obtained proportionate to the claim; liability determination documented; fraud indicators reviewed | File documentation |
| Reserving | Initial reserve supportable; changes documented and authorized; analytics on adequacy and stair-stepping; discussion with actuarial | Reserve history, analytics, actuarial reserve study |
| Evaluation and payment | Damages supported (estimates, bills reviewed, wage documentation); authority obtained; payee verified; releases and liens; payment within authority; duplicate and split analytics | Files, payment data, authority logs |
| Denials | Denial letters cite provisions and facts; state language; investigation supports denial; complaints and reopened denials reviewed | Denial sample, complaint log |
| Recoveries | Subrogation referrals where indicated and pursued; salvage recovered and matched; reinsurance recoverables identified and billed | Recovery data, referral logs, reinsurance billings |
| Vendors and TPAs | Onboarding and licensing; contract terms; invoice and estimate review; performance monitoring; TPA oversight program and audits | Vendor files, re-inspection results, TPA audit reports |
| Litigation | Panel counsel; budgets and plans; billing guideline review; authority; excess and reinsurer notices; reserves versus outcomes | Litigated file sample, e-billing data |
| Catastrophe events | Surge licensing; authority changes; QA coverage; contractor controls; duplicate and fraud analytics; regulatory reporting; reinsurance recovery | Event roster, event claim population, filings |
| Fraud | Referral criteria applied; SIU results; fraud bureau reporting; training; internal fraud analytics | Referral data, SIU reports, training records |
| Compliance reporting | Section 111 reporting; unclaimed property and DMF matching (life); prompt-pay interest (health); complaint handling and regulatory inquiries | Reporting logs, matching results, complaint files |
| Systems and data | Access and segregation in the claims system; authority configuration; data integrity to the ledger and the actuarial data | Access reviews, configuration, reconciliations |
A worked engagement: Caldera Mutual’s FY26 claims audit
Caldera Mutual Insurance Group is the Midwestern mutual used in the insurance examples on this site: Caldera P&C writes $1.9 billion of personal and small commercial premium across 14 states through about 2,400 independent agencies and two managing general agents, Caldera Life writes $0.5 billion, and the group’s 18-person internal audit function works an 88-entity universe. The claims organization handles about 290,000 new P&C claims a year and pays about $1.2 billion of losses and adjusting expense through 1,100 claims employees, two independent adjusting firms for catastrophe surge, a direct repair network of 640 shops, a medical bill review vendor and a third-party administrator for a small commercial book written outside the footprint. The FY26 claims audit (640 hours, the largest engagement in the plan) covered personal auto, homeowners and small commercial property and liability, with the TPA book and the 2025 hailstorm event as targeted modules.
| Test | Result | Rating and outcome |
|---|---|---|
| Timeliness by state (population analytics, 290,000 claims) | Acknowledgment within standard on 96 percent of claims overall, but 88 percent in one state with a 15-day standard and a status-letter requirement the system did not prompt; decision timeliness 93 percent; 2,100 claims lacked the required status letters | High (regulatory). System prompts configured by state; remediation letters issued; disclosed to the state ahead of a scheduled market conduct exam |
| Case reserving, bodily injury (analytics plus 40-file review) | Initial reserves on bodily injury claims from the 2024 accident year averaged 22 percent below ultimate; 38 percent of reserve increases occurred within 30 days of payment; two adjusters accounted for a third of the stair-step pattern; the actuarial function had treated case adequacy as stable | High. Reserving philosophy retrained; supervisory review of initial reserves above $25,000; actuarial reserve study re-run with the adequacy shift, adding $9 million to carried reserves |
| Authority and payments (all 410,000 payments in the year) | 2.1 percent of payments formed split sequences exceeding the adjuster’s authority; 11 duplicate payments totalling $186,000 (eight recovered); payee anomaly analytics flagged one adjuster paying a “contents restoration” vendor registered to a relative’s address on 14 claims ($212,000) | High. Authority measured per claim per payee in the system; duplicate check added before payment release; the adjuster case referred to the SIU and then law enforcement |
| Coverage and denials (120 closed files, 40 denials) | Coverage confirmed from the policy system in all files; 3 of 40 denial letters failed to cite the policy provision; 2 denials were reversed on reopen with facts available at the original decision | Medium. Denial letter template and supervisory review of denials in the two lines concerned |
| Total loss and salvage | 7 of 40 total-loss valuations lacked documented condition adjustments; $2.3 million of salvage proceeds in the auction vendor’s remittances had sat unmatched to claims for more than 90 days | Medium. Valuation documentation standard; salvage reconciliation monthly |
| Subrogation | 9 percent of claims with third-party liability indicators had no subrogation referral; estimated missed recoveries $1.1 million for the year | Medium. Referral automated on liability indicators |
| Vendors and the direct repair network | Re-inspection variance within tolerance network-wide, but four shops with supplement rates double the network average had not been re-inspected in two years; two adjusters steered more than 60 percent of repairs to one shop each | Medium. Re-inspection targeting by supplement rate; steering report to claims management quarterly |
| Litigation management (30 litigated files) | Budgets present in 26; 14 percent of defense invoices paid without review against the billing guidelines; excess carrier notified late on one claim that settled within limits | Medium. E-billing review rule enforced; notification checklist |
| Catastrophe module (2025 hailstorm, 21,000 claims) | 14 surge adjusters worked in two states for 9 to 30 days after their emergency licenses expired; authority raised for surge adjusters was not reversed for six weeks after the event; duplicate analytics found 61 claims paid twice across auto and homeowners policies ($340,000); reinsurance recovery billed correctly | High (licensing). License tracking built into the surge roster; authority reversal made a checklist step; duplicates recovered |
| TPA oversight | The TPA had not been audited by Caldera in three years; a 30-file audit found reserve changes undocumented in 9 and two payments above the TPA’s authority | High. Annual TPA audit program established; authority enforced in the TPA’s system through Caldera’s configuration review |
| Fraud referrals and SIU | Indicator-flagged claims referred at 1.1 percent of claims against a model expectation near 2 percent; the SIU of 24 carried 140 open cases each; fraud bureau reporting complete | Medium. Referral criteria enforced in workflow; SIU staffing case taken to the chief claims officer |
| Section 111 reporting | 4 of 30 reportable settlements reported late in the quarter sampled | Medium. Beneficiary identification moved earlier in the process |
The report rated the claims process Needs Improvement, with the reserving finding carried to the audit committee alongside the chief actuary’s revised estimate, the timeliness finding disclosed to the state regulator ahead of its examination, and the internal fraud case handled under the first 48 hours protocol. Claims management accepted every action; the chief audit executive scheduled validation of the reserving and authority remediation for the second half of FY27 under the standards in the evidence standards for closure guide, with the stair-step analytic rerun as the sustainability test. The insurance pillar places this engagement among Caldera’s reserve, underwriting, agency and ICFR audits.
Failures that recur
| Failure | How it shows | What the audit should do |
|---|---|---|
| Timeliness standards known in general, not by state | One state’s stricter deadline missed systematically | Test by governing state against each standard |
| Reserves managed to a feel | Stair-stepping; actuaries surprised by adverse development | Adequacy analytics by adjuster; talk to the actuaries |
| Authority per payment | Split payments everywhere | Sequence analytics; authority per claim per payee |
| Payee data unmanaged | Adjuster-created vendors; address matches to employees | Payee anomaly analytics every audit |
| Vendors unmonitored | Steering; supplement inflation; TPA never audited | Concentration and supplement analytics; TPA audit program |
| Recovery as an afterthought | Subrogation unreferred; salvage unmatched | Indicator-based referral testing; recovery reconciliations |
| Denials as volume control | Denial letters without provisions; reversals on reopen | Denial sample weighted to high-denial adjusters |
| Catastrophe controls suspended | Unlicensed surge adjusters; authority never reversed; duplicates | Event audit module after every major event |
| Fraud indicators closed for speed | Referral rate far below model expectation | Referral yield analytics; workflow enforcement |
| Litigation on autopilot | Invoices unreviewed; late excess notices; bad-faith exposure | Litigated file sample; billing review testing |
Reporting claims findings
Claims findings carry three audiences at once: claims management, which hears process; the chief financial officer and actuaries, who hear reserves; and the compliance officer and audit committee, who hear regulatory exposure. Write each finding in the five Cs with the condition quantified from the population analytics (rates and dollars across the year, not the sample alone), the cause named as mechanism (system configuration, authority design, caseload, training), and the effect translated for each audience (leakage dollars, reserve adequacy, state exposure). Rate with the severity guide, giving regulatory findings their own weight, and anticipate the response the management responses guide describes: claims leaders will argue each file was handled reasonably, and the audit’s answer is the aggregate the analytics show. Fraud matters are reported through the protocol, not the audit report. The board risk reporting guide shows where leakage, reserve adequacy and regulatory findings belong in the risk committee’s pack, and the regulators’ expectations guide what the state examiner will want to see about the remediation.
Questions about auditing claims
What does a claims audit cover?
The process from first notice of loss to closure: intake timeliness by state, coverage verification, investigation, case reserving, evaluation and payment within authority, denials, recoveries (subrogation, salvage, reinsurance), vendors and third-party administrators, litigation management, catastrophe handling, fraud referral and the special investigations unit, compliance reporting, and the claims system’s access and data, with population analytics for leakage and fraud indicators.
What is claims leakage?
Money paid out or not recovered that proper handling would have avoided: overpaid or duplicate payments, inflated estimates and bills, missed subrogation and salvage, unnecessary litigation cost and payments outside coverage. Industry estimates commonly put it at several percent of indemnity paid; the audit measures it with analytics across all payments and recoveries rather than the file sample alone.
How do you test case reserve adequacy?
Compare initial reserves with ultimate costs on closed claims by line, adjuster and accident year; look for reserve increases shortly before payment (stair-stepping) and claims closing far above reserve; review reserve-setting and changes on a file sample; and discuss results with the actuarial function, because case adequacy shifts distort the company’s reserve estimates.
What are unfair claims settlement practices laws?
State laws based on the NAIC model that require prompt acknowledgment, investigation, decisions and payment within defined deadlines, fair settlement, written denials citing policy provisions and file documentation, enforced through market conduct examinations where a pattern of violations leads to fines, restitution and orders; deadlines differ by state, so the audit tests each claim against its governing state.
How do you audit a third-party administrator?
Test the insurer’s oversight program (contract standards, authority, data access, reporting, bank controls over claim funds) and audit the TPA’s files directly on a sample for reserving, authority, timeliness and documentation, with the frequency set by the book’s size; a TPA never audited by the insurer is a finding in itself.
What fraud analytics belong in a claims audit?
Payee anomalies (addresses and accounts matching employees, payees shared across unrelated claims, adjuster-created vendors), split and duplicate payments, vendor steering by adjuster, reopens with payment, claims with no claimant contact, and the referral yield of indicator-flagged claims against the SIU’s criteria.
Related guides
- Internal audit in insurance — the sector pillar and the insurer’s audit universe.
- Third-party risk management program — the vendor and TPA oversight structure.
- Vendor due diligence by risk tier — how deep to go on each vendor.
- Fraud risk assessment — the method behind the fraud module.
- The ACFE fraud tree explained — the taxonomy of claims fraud.
- Fraud red flags — the indicators.
- When internal audit finds fraud: the first 48 hours — the adjuster case.
- Accounts payable analytics — the payment tests, transferred.
- Procurement fraud schemes — vendor and legal billing schemes.
- Segregation of duties — evaluation versus payee data versus payment.
- IAM audit — claims system access.
- How to audit model risk management — fraud scoring and reserving models.
- Data privacy audit — claimant data.
- The audit work program — structuring the engagement.
- The five Cs of audit findings — writing them up.
- Finding severity ratings — rating them.
- Evaluating management responses — the “each file was reasonable” response.
- What regulators really expect — the market conduct lens.
- Board risk reporting — where the results go.
- Evidence standards for issue closure — validating the fixes.
Leave a Reply