Applying Principles of Internal Control to Insurance Claims

The control environment is the foundation of an internal control system. In insurance, this begins with a corporate culture that prioritizes integrity over speed. According to the U.S. Government Accountability Office (GAO), management must demonstrate a commitment to integrity and ethical values to set the appropriate “tone at the top” [1].

For claims departments, this means:

• Standards of Conduct: Clear policies that forbid adjusters from accepting gifts from repair shops or settling claims for friends and family.

• Competence: Ensuring adjusters have the technical expertise to evaluate complex damages. Poorly trained staff lead to “leakage”—unnecessary overpayments that impact the carrier’s bottom line.

• Accountability: Establishing clear reporting lines so that high-dollar settlements require senior-level authorization [1].

Insurers must proactively identify where the claims process could fail. Common risks include “ghost” claims, inflated medical bills, and internal collusion.

As part of their risk management, many insurers now utilize the NAIC Own Risk and Solvency Assessment (ORSA), which requires companies to evaluate their risk capital and prospective solvency [2]. In the context of claims, risk assessment involves:

• Fraud Identification: Identifying high-risk patterns, such as claims filed shortly after a policy is issued. While this is common in instant-issue insurance policies, rigorous backend controls are necessary to prevent abuse.

• Objective Setting: Defining what a “successful” claim looks like (e.g., accuracy, speed, and customer satisfaction) and measuring deviations from these goals.

Control activities are the “actions” taken to mitigate risk. In a claims environment, two activities are paramount: segregation of duties and rigorous documentation.

Segregation of Duties

A single employee should never have “end-to-end” control over a claim. To prevent internal fraud, the person who approves the vendor (like a body shop) should not be the same person who issues the final payment. This principle is a staple of the COSO model and ensures multiple sets of eyes on every transaction [3].

The Antifraud Plan

Most states now require insurers to maintain a formal Antifraud Plan. The NAIC Antifraud Plan Guideline notes that failure to dedicate resources to fraud detection can directly affect an insurer’s financial stability and the rates charged to consumers [4]. These plans typically include:

• Mandatory reporting to Special Investigation Units (SIUs).

• Regular audits of closed claim files.

• The use of data analytics to flag suspicious activity.

For internal controls to work, the data moving through the system must be accurate. The NAIC Valuation Manual emphasizes the importance of data quality for actuarial and financial reporting [5].

In the claims department, this means that every interaction—phone calls, photos of damage, and medical receipts—must be time-stamped and stored in a tamper-proof system. This level of transparency is one of the key features of the best car insurance companies, as it ensures that if a claimant disputes a denial, there is a clear “paper trail” to justify the company’s decision.

Internal controls are not a “set it and forget it” solution. Continuous monitoring is required to ensure controls are actually being followed.

• Internal Audits: Independent teams should periodically review a random sample of claims to ensure adjusters followed all protocols.

• External Oversight: State regulators often conduct market conduct examinations to verify that insurers are complying with state laws regarding fair claims settlement practices [4].

Core Principles applied to Claims:

• Integrity: Establish a “Tone at the Top” that rejects unethical settlements.

• Segregation: Ensure no single person can authorize and pay a claim.

• Fraud Prevention: Use a formal Antifraud Plan as guided by the NAIC.

• Verification: Rigorous documentation is required to support every payout.

Action Plan for Insurers:

1. Map the Claims Journey: Identify every touchpoint from the initial First Notice of Loss (FNOL) to final payment.
2. Assign Approval Limits: Set “authority levels” where larger payouts require mandatory supervisor sign-offs.
3. Implement Data Analytics: Deploy software to flag claims with “high-risk” indicators (e.g., duplicate invoices or high-frequency claimants).
4. Regular Training: Conduct quarterly workshops on ethics and updated fraud schemes to keep adjusters sharp.

By adhering to these internal control standards, insurance companies protect their shareholders from loss and their policyholders from the rising premiums associated with unmanaged risk and fraud.