A delegated authority partner has settled claims outside its authority limits for months. The board wants to know whether the issue is isolated, whether other claims are affected, and whether management's existing controls can be trusted. In that situation, internal audit in an insurance company provides independent assurance that underwriting, claims, financial reporting, governance and outsourcing controls operate as designed, and that known weaknesses are properly remediated.
The practical challenge is proving that assurance with evidence rather than a completed checklist. UK insurers need an audit function that can test customer outcomes, prudential controls, fraud populations, outsourced resilience and model-to-outcome differences, then maintain a defensible trail from finding to corrective action.
Table of Contents
- Why Internal Audit Matters for an Insurance Company
- The UK Regulatory Framework That Shapes the Audit
- Scoping and Building a Risk-Based Audit Plan
- Testing Claims and Underwriting in Practice
- Auditing Operational Resilience Across Outsourced Providers
- Investigating Profitability Differences and Model Assumptions
- Reporting, Remediation and Next Steps
Why Internal Audit Matters for an Insurance Company
Internal audit matters because insurance companies make decisions through interconnected systems. A pricing assumption affects underwriting decisions, reserving and management information. A claims-handling weakness can create customer harm, financial leakage, inaccurate reserves and regulatory concern at the same time. An outsourced administrator can weaken several of those controls without appearing in the insurer's own operating environment.
The Bank of England has described the Head of Internal Audit as holding a distinct senior-manager responsibility, with an expectation that the role reports to the audit committee chair while the chair sets objectives and evaluates performance. The Bank of England's supervisory expectations for internal audit also make clear that supervisors meet internal-audit teams, review audit reports and examine how findings have been addressed.
The three pressures facing audit leaders
Regulatory scrutiny means an insurer's internal-audit quality can influence the PRA's assessment of risk management and controls. The function's work therefore has consequences beyond the audit committee pack.
Board challenge requires more than confirmation that a policy exists. Directors need to know whether the policy operated, whether exceptions were investigated, and whether management reduced residual risk.
Fast-moving incidents demand a plan that can change. A serious claims anomaly, provider outage or unexplained profitability movement may justify responsive assurance or forensic work during the year.
A useful distinction is between compliance evidence and assurance evidence. A signed procedure demonstrates intent. A reconciled claims population, approved exception report, system log and retested remediation demonstrate operation.
Practical rule: An audit finding isn't closed because management completed an action. It's closed when testing shows that the underlying risk has reduced.
The same discipline applies outside insurance. Teams assessing technology control environments may benefit from this affordable IT audit F1Group guide when considering how access, change and recovery controls should be evidenced.
The following work should sit within a proportionate plan: regulatory reporting, underwriting authority, claims and reserving, delegated arrangements, reinsurance, data quality, operational resilience and customer outcomes. The value lies in connecting those areas, not reviewing each one in isolation.
The UK Regulatory Framework That Shapes the Audit
UK insurers operate within a dual-regulatory structure established under the Financial Services and Markets Act 2000 and implemented from 2013. The PRA focuses on prudential safety and policyholder protection, while the FCA focuses on conduct. Internal audit must therefore provide assurance over both financial resilience and customer outcomes.
For insurers within its scope, the PRA Rulebook, Conditions Governing Business 5.1 requires an effective internal audit function. It must assess internal controls and governance, remain objective and independent from operations, and report findings to the governing body. The governing body decides the action required and ensures it is carried out. Check the firm's regulatory perimeter and any applicable modifications before applying these rules.
What the governance evidence should show
A credible audit file should demonstrate:
- A written charter: The remit, authority, independence and access rights are approved by the appropriate governing body.
- A functional reporting line: The Head of Internal Audit can communicate directly with the audit committee chair and raise concerns without operational interference.
- Unrestricted access: Auditors can obtain records, systems, personnel and outsourced-provider evidence relevant to the engagement.
- Competence and proportionality: The function has the skills needed for actuarial, technology, claims, conduct and financial-control work, using specialists where necessary.
- Documented follow-up: Recommendations have owners, due dates, completion evidence and independent validation.
Under rule 5.2 of the same PRA governance rules, the audit function must plan its work across the firm's activities and governance over the coming years. It must set priorities by risk, report its plan to the governing body, provide findings and recommendations at least annually, and verify compliance with the governing body's decisions. In practice, retain the risk assessment, plan, board papers, annual reports, action tracker and follow-up tests.
Regulatory expectations in practice
| Regulator / source | Key expectation for internal audit | Practical implication |
|---|---|---|
| PRA and Bank of England supervisory expectations | Independent assurance, senior accountability and evidence that findings are addressed | The audit committee should see scope, results, management response and validation |
| FCA conduct framework | Assurance over customer outcomes, complaints, claims handling and value measures | Testing should connect operational records to conduct information |
| Solvency II governance rules | Objective, independent internal audit with a risk-based plan and documented follow-up | The plan must cover governance activities, not only accounting controls |
| UK operational-resilience expectations | Evidence that important business services can remain within impact tolerances | Provider dependency, scenario and recovery evidence must be independently tested |
The FCA's value-measures programme includes claims frequency, claims-acceptance rates, average claims payouts, complaint rates and the proportion of premiums paid in claims. The UK guide to FCA operational resilience is a useful companion when translating those expectations into audit scope.
Scoping and Building a Risk-Based Audit Plan
A defensible plan starts with an audit universe, not a list of last year's engagements. For an insurer, the universe should include underwriting, pricing, claims, reserving, reinsurance, investment, finance, regulatory reporting, IT, cyber controls, outsourcing, actuarial processes, compliance, distribution and customer operations.
The risk assessment then ranks those areas using documented criteria. A practical model considers inherent risk, control maturity, the age and significance of previous findings, recent incidents, regulatory attention, management change and the potential effect on policyholders or financial reporting. The exact scoring method matters less than consistency, explanation and committee challenge.
Five planning decisions that stand up to challenge
- Define the exposure. State which risk the engagement addresses and what could happen if the control fails.
- Map existing assurance. Identify work performed by compliance, risk, quality assurance, external audit and providers. Avoid assuming that second-line testing removes the need for independent audit.
- Assess coverage gaps. A process that hasn't been audited recently may warrant attention even where management reports no current issue.
- Set the depth of work. A smaller insurer may reasonably perform fewer deep dives, provided the shortened universe and resulting residual coverage gap are documented.
- Reserve capacity. The plan needs room for incidents, regulatory requests, thematic reviews and targeted forensic work.
A sound plan reads clearly to the audit committee. Each engagement links to a principal risk, the selected priority has a recorded rationale, and exclusions are visible rather than hidden. The plan should also distinguish internal audit's role from management ownership. Auditors assess and report. They shouldn't design controls, approve underwriting decisions or own remediation.
Common failures are predictable. Some functions audit only financial controls and overlook claims leakage. Others exclude outsourced administrators even though the provider performs the customer-facing activity. Model risk is often left to finance or actuarial teams without independent testing of data lineage and governance. Duplication with compliance can consume capacity while leaving operational resilience untested.
A documented professional risk assessment process can help structure the assessment, but the insurer must apply its own risk appetite, regulatory obligations and business model. The resulting internal audit methodology should explain how risk scores become scope, testing procedures, ratings and follow-up.
Testing Claims and Underwriting in Practice
Consider a hypothetical motor-claims audit at a mid-sized UK insurer. The audit team begins by obtaining the complete population of paid, outstanding and repudiated claims for the review period. It segments the population by claim value, product, handler, referral source, geography and third-party administrator, then gives additional attention to unusual payment patterns and authority-limit exceptions.
The purpose isn't to treat every anomaly as fraud. An anti-fraud indicator may reflect poor data, an operational mistake or a genuine concern. Testing should establish whether the referral rule operated, whether the case was investigated and whether the final decision was supported by evidence.
Preventive and detective controls
Preventive controls should include policy validation, identity checks, delegated authority limits, claims-handler mandates, segregation of duties and anti-fraud referral rules. Detective controls include supervisor reviews, exception reporting, post-payment analytics and trend analysis. Each control needs a named owner, a defined system and a clear evidence source.
For each selected claim, the auditor reconciles:
- Coverage: Policy terms, endorsements, inception and cancellation records.
- Notification: First-notification data, timestamps and recorded circumstances.
- Assessment: Adjuster notes, photographs, third-party evidence and repair information.
- Authority: Reserve changes, payment approvals and delegated limits.
- Accounting: Payment records, reserve movements and the general ledger.
- Outcome: Settlement, repudiation or recovery decision, with management commentary where exceptions exist.
| Population stratum | Sample size | Control tested | Evidence required |
|---|---|---|---|
| High-value paid claims | Risk-based selection | Authority, approval and payment integrity | Claim file, approval trail, payment record and ledger reconciliation |
| Outstanding claims | Risk-based selection | Reserve governance and review | Reserve history, adjuster notes, review sign-off and exception report |
| Repudiated claims | Risk-based selection | Policy interpretation and customer communication | Policy wording, decision rationale, correspondence and complaint record |
| Claims handled by a third party | Risk-based selection | Delegated authority and oversight | Contract, provider MI, file evidence and insurer review record |
| Referred claims | Risk-based selection | Anti-fraud referral and investigation | Referral trigger, investigation record, decision and escalation evidence |
Sampling claims and assessing fraud risk
The sample size should be justified by population characteristics, risk and the precision required. A small random sample may provide comfort over routine processing, but it won't necessarily identify concentrated failures by handler, intermediary or provider. High-risk strata need targeted testing, with the selection logic retained in the workpapers.
The commercial importance is substantial. The ABI's 6 October 2026 fraud release reports £1.34 billion of detected fraudulent claims in 2025 across 93,900 cases, averaging £14,300. Exaggerated-loss cases totalled 26,900; motor claims accounted for 55% of detected cases. Detected travel-fraud cases rose 85%. These are detected cases, not an estimate of all fraud. As a practical audit response, review fraud-risk scoring regularly and when claims patterns change.
A defensible file preserves extracts, selection criteria, screenshots, recalculations, exception logs and management comments. The report should separate control failure, financial leakage, customer impact and suspected fraud. A suspected issue may require a separate investigation, preserving independence and avoiding prejudgment. Specialist insurance claims analysis can support quantification where the review moves beyond control testing.
Auditing Operational Resilience Across Outsourced Providers
A provider's assurance report is useful, but it isn't proof that the insurer can remain within its own impact tolerance. Internal audit needs to trace the chain from the important business service to the dependencies that support it, then test whether recovery performance is achievable under stress.
The PRA's operational-resilience policy was fully implemented in March 2025. Current supervisory priorities emphasise resilience as part of risk culture and decision-making, while FCA expectations require in-scope insurers to map important business services, set impact tolerances, test vulnerabilities and complete lessons-learned activity. The PRA's 2026 insurance supervision priorities also identify growing reliance on externally supplied services and expectations around material third-party arrangements and qualifying operational incidents.
Four layers of evidence
Contractual mapping should connect the service to provider obligations, service levels, audit rights, exit provisions, data access and relevant SS2/21 arrangements. Stale contracts or missing data-repatriation terms create a governance weakness before an incident occurs.
Governance evidence includes joint operating committees, management information, risk acceptance records, issue logs, provider attestations and records showing that the insurer exercised its right to audit. Minutes should show challenge, not just attendance.
Scenario testing should examine failover, manual workarounds, communications, staffing, data restoration and escalation. A tabletop exercise can expose dependency failures that a policy review misses.
Impact-tolerance proof compares measured recovery time and recovery-point performance with the board-approved tolerance. It should use evidence from testing and real incidents, not an unverified statement that recovery is achievable.
Concentration risk deserves separate attention. Several critical services may depend on one cloud environment, business-process outsourcer, data feed or specialist administrator. The audit should identify common dependencies, assess whether exit plans have been tested and examine how the insurer would continue claims, policy administration or payments if that provider became unavailable.
A useful challenge is simple: which evidence would remain if the provider's self-attestation were removed? The answer should include test results, incident records, system logs, contractual rights and independent scenario outcomes.
The audit should also record where responsibility sits. The provider may operate the control, but the insurer remains responsible for oversight and for demonstrating that the service supports safe and sound operation.
Investigating Profitability Differences and Model Assumptions
A persistent gap between modelled and actual profitability is not automatically an actuarial error. It may arise from poor source data, underwriting mix, reserve development, management overrides, reinsurance structure, acquisition-cost treatment or a combination of factors. Internal audit should investigate the full chain before assigning a root cause.
The PRA's 2026 priorities highlight pressure in the bulk purchase annuity market, rapid growth in funded reinsurance and increased engagement with insurers showing material differences between actual and assumed profitability in internal models. Related commentary identifies weaknesses in data quality and standards, together with a need for further investment in internal infrastructure for prudential risk management. Those observations make data lineage and model governance audit matters, not technical issues that can be left entirely to finance or actuarial teams.
A structured investigation
The first review compares plan and actual results by product, channel, underwriting year and material portfolio. The analysis should identify whether the variance comes from price, volume, mix, claims experience, expenses, reserves or reinsurance.
The second stage independently recalculates selected assumptions and traces them to approved methodology. The work may examine discount rates, lapse, morbidity, expenses, loss ratios, claims development and acquisition-cost amortisation, depending on the business. The auditor needn't recreate the entire model if targeted recalculation can isolate the relevant driver.
The third stage tests data lineage. Source records should reconcile to actuarial inputs, management information and board reporting. Missing fields, manual adjustments, inconsistent definitions and unexplained overrides should be logged rather than absorbed into a general data-quality finding.
Distinguishing the cause
A model error may involve inappropriate methodology, coding or parameter application. A data error may involve incomplete claims records, incorrect classifications or a broken interface. A potential deliberate misstatement requires stronger indicators, such as repeated overrides linked to incentives, unexplained commission movements or suspicious reinsurance arrangements.
Escalation into forensic work becomes appropriate when the variance remains unexplained after routine assurance procedures, when financial exposure needs quantification, or when records suggest possible misconduct. The hand-over should preserve the audit trail, define the new purpose, restrict access where appropriate and avoid allowing management to rewrite the original evidence.
The result should state what was tested, what remains uncertain, the estimated exposure where it can be supported, and whether the issue affects reporting, capital, customer outcomes or governance. It should not imply intentional wrongdoing without evidence.
Reporting, Remediation and Next Steps
An insurer's audit report should allow a director to understand the issue without reading every working paper. The executive summary should state the scope, overall rating, principal findings, root causes, residual risk and the effect on policyholders, financial reporting or prudential governance.
Each finding should then identify the control objective, condition, cause, consequence and corrective action. Management actions need a named owner, target date, evidence requirement and agreed validation method. A promise to “improve oversight” isn't a sufficient action unless the report defines what oversight will look like and how its operation will be tested.
Turning findings into reduced risk
An issues log should record the original finding, risk rating, owner, due date, status, evidence received, validation result and residual risk. Audit committee reporting should distinguish completed actions from actions independently verified. Overdue, partially implemented or repeatedly extended actions should trigger escalation.
The audit committee should also ask whether the proposed control is proportionate. A control that costs more than the exposure it addresses may be redesigned, but management should document the decision, the accepted residual risk and the basis for approval. Cost efficiency doesn't justify removing a key control without understanding the consequence.
An auditor can remain independent while using second-line work. The key is to assess the reliability of that work rather than adopt its conclusion automatically. The file should show the scope, methodology, competence, evidence quality and limitations of the earlier review.
Confidentiality requires disciplined handling of regulator-facing material, personal data, suspected-fraud records and legally sensitive communications. Access should be restricted according to the engagement need, with clear retention and disclosure decisions. Audit work isn't legal representation, and a forensic review doesn't guarantee recovery, litigation success or a particular regulatory outcome.
Final evidence and sign-off checklist
A practical sign-off checklist includes:
- Scope confirmation: The approved scope, exclusions and limitations are recorded.
- Evidence index: Key extracts, reconciliations, interviews, screenshots and approvals can be located.
- Finding agreement: Management comments address fact, cause, consequence and action.
- Validation plan: Follow-up testing states what evidence will demonstrate reduced risk.
- Lessons learned: The result informs the next risk assessment and audit plan.
- Committee record: The governing body receives the report and records its response.
A concise guide to audit documentation requirements for 2026 may help teams review the completeness of their evidence standards, but insurance firms must apply their own regulatory perimeter, confidentiality duties and audit charter.
Before sign-off, the reviewer should confirm the memo, evidence-pack index, lessons-learned entry and proposed next-year plan amendment. Those records create the defensible trail that regulators and boards need when asking not only what failed, but what changed afterwards.
Lighthouse Consultants provides independent internal audits, risk assessments and forensic financial analysis for insurers and risk leaders, including control testing, claims analysis and evidence-led reporting. Book a free consultation to discuss the records, scope and next steps for an insurance-control or profitability issue. Call +44 20 7871 0485 or email info@lighthc.london.
