Insurance is the industry where the product is a promise priced before its cost is known. Premium arrives first; the claim, if it comes, arrives months or decades later; and everything in between (the reserves that estimate what will be owed, the capital that stands behind the estimate, the investments that fund it, the reinsurance that shares it) is a judgment that regulators, actuaries, auditors and boards argue about. Internal audit in an insurer is shaped by that inversion. The function audits estimates as much as transactions, works inside a supervisory system that examines the company on a fixed cycle and reads internal audit’s reports, deals with distribution that runs through agents and brokers the company does not employ, and covers a product set (property and casualty, life and annuities, health, reinsurance) whose risks differ enough that a function covering more than one segment is really running two audit programs.
This guide explains how the function works in insurers and reinsurers: why insurance audit is different, the regulatory frame in the United States and abroad, the accounting regimes, the segments and their risks, the shape of an insurance audit universe, how the core processes are audited, the specialist risks, how examiners use internal audit, what the audit committee sees, careers and pay, the failures that recur, and a worked example from Caldera Mutual Insurance Group, the regional property-casualty and life mutual used in the insurance examples on this site. The internal audit in banking guide is the companion for the other half of financial services; the types of internal audits guide covers the engagement types this guide applies to insurance.
In this guide
- Why insurance internal audit is different
- The regulatory frame in the United States
- Solvency II and the international frame
- Three accounting regimes
- Segments and their distinct risks
- The shape of an insurance audit universe
- Auditing the core processes
- Specialist risks: models, market conduct, third parties
- How examiners use internal audit’s work
- What goes to the audit committee
- Careers and pay in insurance internal audit
- Failures that recur
- A worked example: Caldera Mutual’s FY26 audit year
- Questions about internal audit in insurance
- Related guides
Why insurance internal audit is different
Five features of the business shape the function. Estimates dominate the balance sheet: loss reserves at a property-casualty insurer and policy reserves at a life insurer are the largest liabilities, set by actuarial methods on assumptions about frequency, severity, development, mortality, lapse and interest, and a small change in an assumption moves earnings and capital more than any transaction error could. Capital is regulated and formulaic: risk-based capital in the United States and the solvency capital requirement in Europe are computed from prescribed factors and models, with intervention levels that make the calculation itself a control. Distribution is outsourced: independent agents, brokers, managing general agents and digital partners sell the product, bind the company, collect premium and sometimes adjust claims, so that the company’s conduct risk lives in people it does not employ. Supervision is examination-based and cyclical: state insurance departments (in the United States) examine financial condition at least every five years and market conduct as warranted, and they read internal audit’s work. The segments differ: a property-casualty insurer’s risks are catastrophe exposure, reserve adequacy and claims leakage; a life insurer’s are interest rate and longevity risk, policyholder behavior and asset-liability matching; a health insurer’s are medical cost trend, provider contracting and regulatory benefit mandates. The internal audit in financial services guide covers the shared financial services ground.
The regulatory frame in the United States
Insurance in the United States is regulated by the states, coordinated through the National Association of Insurance Commissioners (NAIC), whose model laws and regulations become binding when states adopt them, which the NAIC’s accreditation program for state departments largely ensures. Several of the models speak directly to internal audit. The Annual Financial Reporting Model Regulation (Model 205, the Model Audit Rule) requires an annual audit by an independent CPA, an audit committee with independence requirements scaled to premium (no minimum below $300 million of direct and assumed premium, a majority independent between $300 million and $500 million, 75 percent independent above $500 million), and, for insurers above $500 million of direct written and unaffiliated assumed premium, a management report on internal control over financial reporting; the 2014 amendments, an accreditation standard from 1 January 2020, require insurers above that threshold (and insurer groups above $1 billion) to maintain an internal audit function that is organizationally independent, headed by someone with direct and unrestricted access to the board, and reporting to the audit committee at least annually on the audit plan, independence, material findings and the appropriateness of corrective actions. The Risk Management and Own Risk and Solvency Assessment Model Act (Model 505) requires insurers above the same thresholds to maintain a risk management framework and file an annual ORSA Summary Report describing their risk assessment and prospective solvency under stress. The Corporate Governance Annual Disclosure Model Act (Model 305) requires an annual filing describing governance structures, board and committee practices, and the oversight of critical functions, due 1 June. The Insurance Data Security Model Law (Model 668, 2017), adopted by a majority of states, requires an information security program, risk assessment, incident response and 72-hour breach notification to the commissioner, with New York’s Part 500 regulation as its stricter precursor. Risk-based capital formulas by segment produce a ratio with intervention levels (company action, regulatory action, authorized control, mandatory control) that trigger escalating supervisory responses. Financial condition examinations occur at least every five years under the Model Law on Examinations, using a risk-focused approach that explicitly considers internal audit’s work; market conduct examinations review sales, underwriting, rating, claims and complaint handling against state law. Federal involvement is limited to the Federal Insurance Office’s monitoring role, SEC and SOX requirements for public insurers, and federal programs (crop, flood) with their own rules.
| Requirement | Threshold | What it requires | Internal audit’s role |
|---|---|---|---|
| Model Audit Rule (Model 205): CPA audit; audit committee | All insurers; independence tiers at $300 million and $500 million of premium | Annual audited statutory statements; audit committee composition; auditor independence and rotation rules | Reports to the audit committee; coordinates with the external auditor |
| Model 205: Management’s report on internal control over financial reporting | Above $500 million direct and assumed premium | Annual management assertion on ICFR, filed by 1 August | Tests controls supporting the assertion; often runs the program (the insurance SOX) |
| Model 205: Internal audit function | Above $500 million premium (insurer) or $1 billion (group); accreditation standard since 2020 | Organizationally independent function; head with unrestricted board access; annual reporting to the audit committee on plan, independence, findings and corrective actions | The function’s existence and reporting are themselves regulatory requirements |
| ORSA (Model 505) | Above $500 million (insurer) or $1 billion (group) | Risk management framework; annual ORSA Summary Report with stress testing and prospective solvency | Audits the risk management framework and the ORSA process; examiners expect it |
| Corporate Governance Annual Disclosure (Model 305) | All insurers | Annual governance filing by 1 June | Internal audit’s governance described; the filing’s accuracy tested |
| Insurance Data Security Model Law (Model 668); NY Part 500 | Licensees, with small-entity exemptions | Information security program, risk assessment, incident response, annual certification, 72-hour notification | Audits the program; certifications rely on testing |
| Risk-based capital | All insurers by segment formula | RBC ratio with company action, regulatory action, authorized control and mandatory control levels | Audits the RBC calculation’s inputs and process |
| Financial condition examination (Model 390) | At least every five years | Risk-focused examination of the insurer’s financial condition and controls | Examiners review internal audit reports and may rely on its work |
| Market conduct examination | As warranted; coordinated through the NAIC | Review of sales, underwriting, rating, claims and complaints against state law | Internal audit’s market conduct coverage reduces findings |
| Holding company regulation (Model 440) | Insurance holding company systems | Registration, Form B and Form F filings, affiliate transaction approval, group supervision | Audits affiliate agreements and intercompany transactions |
Solvency II and the international frame
Outside the United States the frame is more unified. The European Union’s Solvency II directive, applied since 1 January 2016 (and retained with amendments in the United Kingdom as Solvency UK), rests on three pillars: quantitative requirements (a market-consistent balance sheet, a solvency capital requirement calibrated to a 99.5 percent one-year confidence level by standard formula or approved internal model, and a minimum capital requirement), governance and supervision (a system of governance with four key functions, risk management, compliance, actuarial and internal audit, the last required by Article 47 to be effective, objective and independent of operations, with a direct line to the board), and disclosure (the public Solvency and Financial Condition Report and the supervisory report). The ORSA originated here as an own risk and solvency assessment every insurer must perform. The International Association of Insurance Supervisors’ Insurance Core Principles set the global standards (ICP 8 requires an internal audit function), and its Insurance Capital Standard, adopted in December 2024 as the prescribed capital requirement for internationally active insurance groups, is being implemented by group supervisors. Internal audit at a European insurer is therefore a statutory function with a defined place in the governance system, which is a stronger position than its American counterpart’s and a heavier expectation: supervisors expect the function’s plan to cover the key functions, the internal model where there is one, and the ORSA, and they read the audit reports in their supervisory review.
Three accounting regimes
Insurers report under up to three bases, and an auditor must know which one a control serves. Statutory accounting principles (SAP), set by the NAIC’s Accounting Practices and Procedures Manual, govern the annual statement filed with state regulators and the RBC calculation; they are conservative (acquisition costs expensed, some assets non-admitted, reserves on prescribed bases) because their purpose is solvency. US GAAP governs the financial statements of public and many private insurers; for long-duration contracts (life, annuities, long-term care) the FASB’s targeted improvements (ASU 2018-12, known as LDTI), effective for larger public companies in 2023 and others in 2025, changed reserve assumption updates, market risk benefit measurement and acquisition cost amortization, with substantial new disclosures. IFRS 17, effective 1 January 2023, replaced IFRS 4 for insurers reporting under international standards, with a general measurement model (fulfilment cash flows plus a contractual service margin), a premium allocation approach for short-duration contracts and a variable fee approach for participating contracts, and it changed systems, data and actuarial processes at every insurer that adopted it. Internal audit’s financial reporting work tests the controls over the reserving and valuation processes that feed all three, the reconciliations between bases, and the data lineage from administration systems to actuarial models to the ledger; the financial close guide covers the close process these controls sit in.
Segments and their distinct risks
| Segment | Largest risks | Where internal audit concentrates |
|---|---|---|
| Property and casualty (personal lines) | Catastrophe exposure and reinsurance adequacy; rate adequacy and regulatory rate approval; claims leakage and fraud; reserve adequacy on long-tail lines; agent conduct | Claims handling and vendor management; underwriting and rating controls; catastrophe model governance; reserving process; distribution compliance |
| Property and casualty (commercial and specialty) | Underwriting authority and pricing discipline; large-loss and litigation reserves; reinsurance credit; MGA and delegated authority oversight; social inflation | Underwriting authority audits; delegated authority audits of MGAs; reserve reviews; reinsurance recoverables |
| Life and annuities | Interest rate and credit risk in the investment portfolio against long liabilities; policyholder behavior (lapse, surrender, annuitization); mortality and longevity; guarantees and hedging; suitability and sales practices; unclaimed property and death master file matching | Asset-liability management; actuarial assumption governance; hedging programs; new business suitability; policy administration conversions; escheatment |
| Health | Medical cost trend and pricing; provider contracting and payment integrity; regulatory benefit and network mandates; member data privacy; Medicare Advantage and Medicaid program compliance | Claims payment integrity; provider contracting; regulatory program compliance; HIPAA |
| Reinsurance | Cedant underwriting quality; aggregation and accumulation; retrocession; collateral and credit; contract wording | Underwriting audits of cedants; accumulation controls; contract certainty; collateral management |
| Mutuals and fraternals | Governance without shareholders; surplus management; member conduct expectations | Board effectiveness; surplus and capital planning; policyholder dividend governance |
The shape of an insurance audit universe
An insurer’s audit universe is organized by the insurance value chain plus the corporate functions, with the regulatory programs as standing entities. Caldera Mutual’s FY26 universe, below, has 88 entities in eight domains; the pattern transfers, and the audit universe guide gives the method for building one and the bank audit universe guide a 126-entity comparison from banking.
| Domain | Representative entities (Caldera Mutual, 88 in total) | Typical rating and cycle |
|---|---|---|
| Underwriting and product (11) | Personal auto underwriting and rating; homeowners underwriting; commercial lines underwriting authority; life new business and underwriting; product development and rate filings; agency management and appointments; MGA delegated authority (two programs); pricing models | High for underwriting authority and pricing models (annual); moderate for product filings (two years) |
| Claims (10) | Auto physical damage claims; bodily injury claims and litigation management; property claims and catastrophe response; life and annuity death claims; claims vendors (independent adjusters, repair networks); special investigations unit; subrogation and salvage; claims reserving (case reserves) | High for bodily injury, catastrophe response and claims vendors (annual); moderate for subrogation (two years) |
| Actuarial and reserving (7) | P&C loss reserving process; life policy reserves and assumption governance; Statement of Actuarial Opinion support; catastrophe modeling; reinsurance program design; capital modeling and RBC; ORSA process | High (annual) for loss reserving, assumption governance and RBC; ORSA every two years |
| Reinsurance and investments (8) | Ceded reinsurance accounting and recoverables; reinsurance collateral and credit; assumed reinsurance (small); investment governance and compliance with guidelines; asset-liability management (life); investment accounting and valuation; derivatives and hedging; cash and treasury | High for recoverables and ALM (annual); moderate for investment accounting (two years) |
| Policy administration and finance (14) | Policy administration systems (P&C, life); premium billing and collection; agent commissions; premium tax and surcharges; statutory reporting and annual statement; GAAP reporting and LDTI; ICFR program (Model Audit Rule); financial close; intercompany and affiliate agreements (Form D); unclaimed property and escheatment; expense allocation; payroll; procurement | High for statutory reporting, ICFR and commissions (annual); others two to three years |
| Compliance, conduct and legal (12) | Market conduct program; complaint handling; producer licensing; advertising and sales practices; privacy (state laws, GLBA); anti-fraud plan; AML (life); suitability (annuities); regulatory filings calendar; legal and litigation; Corporate Governance Annual Disclosure; climate risk disclosure | High for market conduct, complaints and suitability (annual); others two to three years |
| Technology and resilience (16) | Information security program (Model 668); identity and access; change management; policy system modernization program; data governance; business continuity and disaster recovery; vendor technology risk; cloud; cyber incident response; data analytics platform; agent and customer portals; telematics data | High for security, access, the modernization program and incident response (annual) |
| Governance and enterprise (10) | Board and committee governance; ERM framework; risk appetite and limits; strategic planning; third-party risk management; model risk management; capital management; mutual holding company governance; human resources; the internal audit function itself (QAIP) | ERM, TPRM and model risk High (annual); others two to three years |
Auditing the core processes
Underwriting audits test that risks are accepted within authority (underwriting guidelines, referral thresholds, exceptions documented and approved), rated correctly (rating algorithms match filed rates; discounts and surcharges supported; data elements such as credit scores and territory used lawfully), and priced adequately (loss ratio monitoring by segment; pricing model governance); samples of bound policies are re-underwritten against the guidelines, and the audit looks hard at exceptions and at any book growing faster than its loss experience is understood. Claims audits test the lifecycle from first notice of loss to settlement: coverage verification, reserve setting and revision (case reserve adequacy against ultimate), investigation and documentation, payment authority and segregation, vendor use (independent adjusters, repair networks, legal panels) and billing, litigation management, subrogation and salvage recovery, fraud referral, and the state regulatory requirements on timing, communication and fair claims practices; claims leakage studies (re-adjudicating closed claims to measure overpayment) are the audit’s most quantitative tool. Reserving audits do not re-perform the actuarial work; they test the process: data completeness and reconciliation from claims systems to the actuarial triangles, method and assumption selection governance, the independence of the reserving actuary from pricing and business pressure, the documentation and challenge of management’s selection within the actuary’s range, the reconciliation of booked reserves to the Statement of Actuarial Opinion, and back-testing of prior estimates against development. Reinsurance audits test program design against the catastrophe model and risk appetite, contract certainty (signed contracts before inception), ceded premium and recoverable calculations, collateral and credit for reinsurance (Schedule F in the United States), and the recovery process on large losses. Investments audits test compliance with board-approved guidelines and state investment law, valuation (particularly of private and structured assets), the NAIC designation process, derivatives and hedging controls, and, for life insurers, asset-liability management against the duration and cash flow of liabilities. Distribution audits test producer licensing and appointments, commission calculation and payment, agency balances and premium trust, delegated authority agreements and the audits of MGAs and third-party administrators the company is entitled to perform, and sales practice monitoring. The order-to-cash and payment operations guides cover the transactional controls that premium and claims payments share with other industries, and the credit parameters guide the counterparty credit analysis reinsurance recoverables require.
| Process | Core tests | Finding that recurs |
|---|---|---|
| Underwriting | Re-underwrite a sample against guidelines and authority; re-rate against filed rates; exception analysis; growth versus loss experience | Authority exceeded on large accounts with retrospective approval; rating variables used that were not in the filing |
| Claims | Lifecycle sample from FNOL to settlement; reserve adequacy; payment authority; vendor billing; leakage study; fair claims practice timing | Reserves not revised after new information; vendor invoices paid without rate card comparison; leakage of 2 to 5 percent on re-adjudicated samples |
| Reserving | Data reconciliation to triangles; assumption governance; management selection within the range documented; back-testing | Management’s selection at the low end of the range with thin documentation; data extracts not reconciled to the claims system |
| Reinsurance | Contract certainty; ceded calculations re-performed; recoverables aged and collateralized; program against the cat model’s PML | Contracts signed months after inception; recoverables aged over 90 days unprovisioned |
| Investments | Guideline compliance; valuation of level 3 assets; designations; hedging effectiveness; ALM reporting | Private credit valuations relying on the manager’s marks; guideline breaches reported late |
| Distribution | Licensing and appointments; commission re-performance; agency balances; MGA audits performed; sales practice monitoring | Commissions paid to unlicensed producers; MGA audit rights never exercised |
| Policy administration and premium | System conversions; billing accuracy; cancellations and non-renewals per state law; premium trust | Legacy system conversions with unreconciled policy counts |
Specialist risks: models, market conduct, third parties
Three specialist areas take a disproportionate share of a mature insurance function’s attention. Model risk: insurers run more consequential models than most banks their size (pricing models, reserving models, catastrophe models licensed from vendors, capital models, asset-liability models, hedging models, and increasingly machine learning in underwriting, claims triage and fraud detection), and the governance frameworks borrowed from banking (the SR 11-7 lineage) apply with the actuarial standards of practice alongside; catastrophe models deserve particular attention because a vendor model’s version change can move the reinsurance program and the capital position overnight, and the vendor model validation guide covers the discipline. Market conduct: state regulators examine how the company treats policyholders (sales practices, underwriting fairness, claims handling timeliness and fairness, complaint handling, advertising, privacy), with findings that carry fines and reputational cost; a market conduct program in compliance, tested by internal audit, is the defense, and the increasing regulatory interest in the use of consumer data and algorithms in underwriting and claims (unfair discrimination, proxy variables) is the newest front. Third parties: agents, MGAs, third-party administrators, claims vendors, reinsurers, asset managers and technology providers perform or affect most of the insurer’s processes, and the function needs a third-party risk program and delegated-authority audit capability of its own; the third-party risk management program guide and the IIA’s Third-Party Topical Requirement guide (mandatory for assurance engagements on third parties since September 2026) give the frame.
How examiners use internal audit’s work
The NAIC’s risk-focused examination approach, used by every accredited state department, has the examiner understand the insurer’s corporate governance, identify key activities and risks, and evaluate the controls that mitigate them, with explicit consideration of the work of internal audit, the external auditor and the ORSA. In practice the examination team requests the audit universe, risk assessment, plan, reports and follow-up status for the examination period, interviews the chief audit executive, assesses the function’s independence and competence, and decides how far to rely on its work; a strong function shortens the examination and narrows its testing, and a weak one produces examination findings about the function itself (plan coverage gaps, late follow-up, insufficient independence). The 2014 Model Audit Rule amendments made the function’s existence, reporting and independence examination items in their own right. European supervisors do the same through the supervisory review process, with the added expectation that internal audit covers the other key functions and the internal model. The function’s relationship with examiners follows the banking pattern in the internal audit in banking guide: issue validation of examination findings, coordination of requests, and candor about what the function has and has not covered.
What goes to the audit committee
Beyond the standard reporting the Global Internal Audit Standards require (plan and progress, results, resources, quality, independence), an insurer’s audit committee receives the Model Audit Rule’s annual internal audit report (plan, independence, material findings, corrective action appropriateness), the ICFR program’s status and management’s assertion support, the reserving and actuarial process audit results alongside the appointed actuary’s opinion, the regulatory calendar (examinations, ORSA, CGAD, data security certifications), the market conduct and complaint picture, the status of examination findings, and the third-party and model risk programs’ coverage. Mutuals add surplus management and policyholder dividend governance; public insurers add SOX. The audit committee annual agenda guide gives the calendar and the board risk reporting guide the risk pack the committee reads beside internal audit’s report.
Careers and pay in insurance internal audit
Insurance internal audit hires from the same pools as other industries (accounting and audit graduates, Big Four alumni, IT auditors) and adds two it needs more than most: actuarial-literate auditors (actuarial students or analysts who moved into audit; auditors who learned to read a reserve study) and claims and underwriting professionals who became auditors of their former processes. Credentials follow the general pattern (CIA, CPA, CISA, CFE, with the certification roadmap guide’s sequencing), plus insurance designations (the CPCU for property-casualty, the FLMI for life, the AIAF for insurance accounting and finance) that signal domain knowledge and are often employer-funded. Pay tracks financial services generally, somewhat below the largest banks and above most industries, with the salary guide‘s ranges applying and a premium for actuarial and model risk skills; mutuals tend to pay slightly less and retain longer. The career paths out of the function run to claims and underwriting operations leadership, risk management (the ORSA made chief risk officer a career destination), compliance and finance, and the function’s exposure to every process in the company makes it a recognized route to general management in mutuals in particular. The career ladder and exit opportunities guides cover the general paths.
Failures that recur
| Failure | How it shows | What the function should do |
|---|---|---|
| Auditing transactions, not estimates | Claims payments and commissions audited every year; the reserving process never | Put the reserving, assumption governance and capital processes in the universe as High entities with co-sourced actuarial support |
| Deference to the actuaries | The function accepts the reserve as given because it cannot read the study | Audit the process, data and governance, which need no actuarial credential; buy the credential for the rest |
| Distribution out of scope | Agents, MGAs and TPAs treated as outside the company | Delegated authority audits; exercise contractual audit rights; third-party program |
| Cat model complacency | Vendor model version changes moving the program and capital without governance | Model risk framework covering licensed models; change impact analysis |
| Modernization programs unaudited until go-live | Policy system replacement audited after conversion, when policy counts do not reconcile | Program assurance at each stage gate; data migration reconciliation testing |
| Market conduct left to compliance | Examination findings on claims timing and complaint handling that internal audit never tested | Market conduct program in the universe; rely on compliance testing only after assessing it |
| ICFR as the whole plan | The Model Audit Rule program consumes the function; operational risk uncovered | Separate the ICFR program’s hours; risk-based plan beyond it |
| Thin regulatory calendar | Filings late; data security certification signed without testing | Regulatory calendar as a standing entity; certifications supported by audit work |
A worked example: Caldera Mutual’s FY26 audit year
Caldera Mutual Insurance Group is the regional mutual used in the insurance examples on this site: a mutual holding company domiciled in a Midwestern state with two insurance subsidiaries, Caldera Property and Casualty ($1.9 billion of direct written premium in personal and small commercial lines across fourteen states, distributed through about 2,400 independent agencies and two managing general agents) and Caldera Life ($0.5 billion of premium in term life and fixed annuities), about 2,900 employees and total admitted assets of $7.8 billion. It is above every Model Audit Rule and ORSA threshold, files an ICFR management report, is examined by its domestic regulator every five years (last in 2023) and has an eighteen-person internal audit function whose chief audit executive reports to the audit committee (five of seven directors independent, satisfying the 75 percent requirement) and administratively to the chief executive. The FY26 plan covered 31 of the 88 universe entities in 24,600 hours, with 1,900 hours co-sourced (actuarial process review, penetration testing, catastrophe model governance).
| Engagement (hours) | What it found | Outcome |
|---|---|---|
| P&C loss reserving process (640, including 220 co-sourced actuarial) | Data reconciliation from the claims system to the triangles complete; management’s selection sat at the 38th percentile of the actuary’s range for the auto bodily injury line for the third consecutive year with a one-paragraph rationale; back-testing showed adverse development on that line in two of three prior years | Medium: selection governance strengthened with a documented rationale standard and reserve committee minutes; the committee asked the appointed actuary to present the range annually |
| Claims leakage study, auto bodily injury (520) | Re-adjudication of 150 closed claims found leakage of 3.1 percent of paid losses, concentrated in medical bill review bypasses and duplicate payments to a legal vendor; fair claims practice timing met in 96 percent of the sample | High: bill review bypass control redesigned; vendor billing analytics introduced; $2.4 million annualized leakage reduction estimated |
| MGA delegated authority (two programs, 480) | One MGA bound 31 risks outside its authority in the year, including two above the program’s per-risk limit; the contractual audit right had never been exercised; bordereaux reconciled | High: authority breaches referred to the program’s underwriting committee; annual MGA audits scheduled; one program put on notice |
| Catastrophe model governance (300, 120 co-sourced) | Vendor model version change in 2025 increased the hurricane probable maximum loss by 11 percent; the reinsurance program had been renewed on the prior version with no documented impact analysis; the capital model used a third version | High: model change governance with impact analysis before program renewal; version alignment across reinsurance, capital and pricing |
| Information security program (Model 668) (560, 200 co-sourced penetration testing) | Program in place; annual certification supported; penetration test found two critical findings in the agent portal remediated within the engagement; MFA complete | Medium: portal findings; certification process confirmed |
| Life policy administration system conversion (program assurance, 700 across three stage gates) | Data migration reconciliation at the second gate showed 214 policies with reserve differences above tolerance; the program’s own testing had not caught them because the tolerance was set on count, not value | High at gate two; corrected before conversion; go-live reconciliation clean |
| ORSA process (320) | Framework documented; stress scenarios current; the ORSA Summary Report’s liquidity stress had not been updated for the 2025 reinsurance program change | Low; corrected before filing |
| Annuity suitability and sales practices (380) | Suitability reviews documented; four producers with replacement rates above the threshold had not been escalated under the monitoring program | Medium: escalation applied; monitoring thresholds reviewed |
| ICFR program (Model Audit Rule) (2,400) | 188 key controls tested; three deficiencies, none significant | Management assertion supported; filed 1 August |
| Validation of 2023 examination findings (260) | Six findings; five validated closed; one (affiliate agreement approvals) re-opened | Reported to the committee and the regulator ahead of the 2028 examination |
The chief audit executive’s annual report to the committee under the Model Audit Rule stated the plan’s completion (29 of 31 engagements, two deferred to FY27 with the committee’s approval), confirmed independence, summarized the four High findings and reported that 41 of 47 corrective actions due in the year had been validated closed with the six overdue escalated. The committee’s own observation was that three of the four High findings (leakage, MGA authority, cat model governance) had come from entities the function had added to the universe only after a 2024 external quality assessment questioned why distribution and models were rated moderate; the external quality assessment guide covers that kind of review. The third-party risk, vendor model validation and model risk management guides carry the methods the engagements used.
Questions about internal audit in insurance
Is internal audit required at insurance companies?
In the United States, insurers with more than $500 million of direct written and unaffiliated assumed premium (or groups above $1 billion) must maintain an organizationally independent internal audit function under the NAIC’s Model Audit Rule, an accreditation standard since 2020. In the European Union, internal audit is one of the four key functions every insurer must have under Solvency II.
How does insurance internal audit differ from bank internal audit?
Insurance audit centers on estimates (reserves, assumptions, models) rather than on transaction volumes, deals with distribution through independent agents and MGAs the company does not employ, and operates under state examination cycles and NAIC model rules rather than federal bank supervision. Both share capital regulation, financial reporting controls and examiner reliance on internal audit’s work.
Does internal audit audit the actuaries?
It audits the reserving and assumption-setting process: data completeness, method and assumption governance, management’s selection within the actuarial range, independence, documentation and back-testing. It does not re-perform the actuarial calculation, and functions co-source actuarial expertise where the process audit needs it.
What is the Model Audit Rule’s internal audit requirement?
Insurers above the premium thresholds must have an internal audit function that is organizationally independent, headed by someone with direct and unrestricted access to the board, and that reports to the audit committee at least annually on the audit plan, factors affecting independence or effectiveness, material findings and the appropriateness of corrective actions.
What should an insurance audit universe contain?
The value chain (underwriting and product, claims, reserving and actuarial, reinsurance and investments, policy administration and finance, distribution), the compliance and conduct programs (market conduct, complaints, licensing, suitability, privacy, anti-fraud), technology and resilience, and governance entities (ERM, ORSA, model risk, third-party risk, capital), with the regulatory programs as standing entities.
How do insurance regulators use internal audit’s work?
Under the NAIC’s risk-focused examination approach, examiners review the audit universe, plan, reports and follow-up, assess the function’s independence and competence, and decide how far to rely on its work; a strong function narrows the examination. European supervisors read internal audit’s reports in the supervisory review and expect coverage of the other key functions and the internal model.
Related guides
- Internal audit in banking — the companion guide for the other half of financial services.
- Internal audit in financial services — the shared ground.
- A bank audit universe worked example — a 126-entity comparison.
- How to build an audit universe — the method behind Caldera’s 88 entities.
- How to audit model risk management — the framework for pricing, reserving and catastrophe models.
- Vendor model validation — licensed catastrophe models.
- SR 11-7 and SR 26-2 explained — the model risk guidance insurers borrow.
- Third-party risk management program — agents, MGAs, TPAs and vendors.
- Third-Party Topical Requirement — mandatory for third-party assurance engagements.
- How to audit the financial close — statutory, GAAP and IFRS 17 reporting controls.
- How to audit order-to-cash — premium billing and collection.
- Fraud risk assessment — claims and agent fraud.
- The audit committee annual agenda — the insurer’s committee calendar.
- Board risk reporting — the risk pack beside internal audit’s report.
- Certification roadmap by career stage — adding insurance designations.
- Internal auditor salary guide — pay in financial services.
- Auditing Insurance Claims: FNOL to Settlement Program — first notice of loss to settlement: reserving, authority, vendors, fraud and leakage.
Leave a Reply