13. Audit, Internal Control, Taxation, Ethics and Governance

Introduction and Context

Insurance accounting and financial management operate in an environment where financial statements are affected by uncertainty, long-term contracts, estimates, regulation and public confidence. An insurer may receive premiums today, incur claims many years later, invest substantial funds on behalf of policyholders, and rely on actuarial models to estimate obligations that cannot yet be observed directly. These characteristics make audit, internal control, taxation, ethics and governance central to the credibility and solvency of the insurance enterprise.

Audit does not merely verify whether figures have been added correctly. It evaluates whether reported information faithfully represents the insurer’s economic position, whether controls reduce material error and fraud, and whether management has complied with applicable law and accounting requirements. Internal control provides the operating architecture through which risks are identified, authorized, recorded, monitored and corrected. Taxation affects product design, investment decisions, profitability and capital allocation. Ethics and governance determine whether decisions are made in the interests of policyholders, shareholders, employees, regulators and other stakeholders.

This chapter examines these subjects as an integrated system. Weak governance can produce poor controls; weak controls can undermine audit evidence; unreliable accounting can result in incorrect tax reporting; and ethical failures can convert an operational weakness into a regulatory or reputational crisis.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the purpose, scope and evidence requirements of an insurance audit.

2. Design internal controls over underwriting, claims, investments, actuarial models and financial reporting.

3. Identify significant insurance fraud risks and evaluate control responses.

4. Apply basic taxation principles to insurance operations and distinguish accounting profit from taxable income.

5. Explain the responsibilities of boards, committees, senior management, actuaries, auditors and other fiduciaries.

6. Evaluate ethical dilemmas involving customers, intermediaries, investments, claims and disclosure.

7. Assess the effect of technology, analytics and artificial intelligence on assurance and governance.

8. Apply these principles to an integrated insurance-management case.

The Assurance Architecture of an Insurer

An insurer’s assurance architecture consists of several related but distinct layers. Management owns risks and designs controls. The risk-management function identifies and assesses enterprise risks. Compliance monitors adherence to laws, regulations and internal policies. Internal audit independently evaluates the design and operating effectiveness of controls. The external auditor provides an independent opinion on the financial statements. The board and its committees oversee the entire structure.

The three-lines model is useful in explaining these relationships. The first line comprises operational functions such as underwriting, claims, investments and finance. These functions own day-to-day risks. The second line comprises risk management, compliance, actuarial oversight and related control functions. The third line is internal audit, which provides independent assurance to the board. External audit is not a management control and does not replace internal audit; it provides an external opinion for users of the financial statements.

Insurance audits require particular attention because significant balances are based on estimates. Premium income may involve complex recognition rules, claims may be reported late, reserves may depend on assumptions about frequency and severity, and investment values may fluctuate with market conditions. Audit quality therefore depends on understanding the insurer’s business model, data flows, controls and assumptions rather than examining ledger balances in isolation.

Audit objectives and risk assessment

The broad objectives of a financial statement audit are to obtain reasonable assurance that the statements are free from material misstatement, whether caused by error or fraud, and to report an independent opinion. Reasonable assurance is a high, but not absolute, level of assurance. An audit cannot eliminate all risk because of sampling, professional judgment, management estimates and the possibility of collusion or concealment.

The auditor normally assesses risk at two levels. Financial-statement-level risks affect the statements broadly, such as weak governance, aggressive performance targets or inadequate finance personnel. Assertion-level risks relate to particular balances or disclosures. Common assertions include occurrence, completeness, accuracy, cut-off, classification, valuation, rights and obligations, and presentation.

For example, the completeness of claims liabilities is a major concern because claims incurred before the reporting date may not yet have been reported. Valuation is important for unpaid claims and policyholder liabilities because estimates depend on actuarial assumptions. Existence and rights are relevant to investments, while occurrence and cut-off are important for premiums and commissions.

Audit evidence in insurance

Audit evidence includes information obtained from accounting records and from independent or corroborating sources. Evidence may include policy registers, premium receipts, reinsurance contracts, claims files, payment records, actuarial reports, investment confirmations, bank statements, legal correspondence, board minutes and system logs.

The reliability of evidence generally increases when it is obtained directly by the auditor from an independent external source. A confirmation from a custodian regarding securities may be stronger than an internally prepared investment schedule. Nevertheless, external evidence must be evaluated critically: a confirmation may not establish valuation, ownership restrictions or impairment.

Substantive procedures test balances and transactions directly. Tests of controls assess whether controls operated effectively during the period. In a well-controlled automated environment, the auditor may combine control testing with data analytics and targeted substantive procedures. Where controls are weak, the auditor generally increases substantive testing and may involve specialists, particularly actuaries, valuation experts, information-technology specialists or tax professionals.

Materiality and professional scepticism

Materiality concerns whether an omission or misstatement could influence the decisions of users. Quantitative size is relevant, but qualitative factors also matter. A small misstatement may be material if it changes a regulatory capital ratio, conceals a breach of a covenant, affects executive remuneration or turns a loss into a profit. Professional scepticism requires a questioning mind and critical assessment of contradictory evidence. It is especially important when management assumptions produce unusually favourable reserve or investment results.

Internal Control by Insurance Activity

Internal control is a process, not a single document or department. A sound control system includes a control environment, risk assessment, control activities, information and communication, and monitoring. Controls may be preventive, detective or corrective; manual, automated or hybrid; and financial, operational or compliance-oriented.

Underwriting and premium controls

Underwriting controls should ensure that risks are accepted only within approved authority, pricing is supported by adequate information, policy terms are properly recorded, and prohibited or restricted risks are identified. Important controls include delegated-authority limits, independent review of exceptional risks, sanctions and customer screening, approval of discounts, verification of policy documentation and reconciliation of policy administration records to the general ledger.

Premium controls address completeness, accuracy and cut-off. The insurer should reconcile quotations, issued policies, endorsements, cancellations, collections and receivables. Interfaces between underwriting systems and finance should be controlled through validation checks, exception reports and access restrictions. Unusual manual journals, backdated endorsements and excessive cancellations require investigation because they may indicate manipulation of revenue or commission.

Claims controls

Claims are exposed to misrepresentation, duplicate payments, inflated losses, fictitious claimants, conflicts of interest and premature or delayed settlement. A robust claims process separates claim registration, assessment, authorization and payment. It uses documented coverage checks, identity verification, reserve approval levels, independent review of large or unusual claims, payment validation and post-settlement analysis.

Claims data should be reconciled to bank payments and the claims sub-ledger. Closed claims should not be reopened without authorization. Changes to reserves, claimant bank details and settlement instructions should generate an audit trail. Analytical indicators such as repeated claims by the same provider, unusual geographic concentrations, rapid settlement patterns or relationships among claimants and service providers can support fraud detection, but analytics should not replace fair investigation.

Investment controls

Investment controls protect assets, ensure compliance with investment mandates and support reliable valuation. They include board-approved investment policies, counterparty and concentration limits, segregation between dealing and custody, independent trade confirmation, settlement reconciliation, valuation controls and impairment review.

The front office may propose or execute trades, the middle office may monitor risk and limits, and the back office may confirm, settle and record transactions. This separation reduces the possibility that one individual can initiate, conceal and benefit from an unauthorized transaction. Investments held through custodians should be independently confirmed. Fair-value models require model governance, independent price verification and documentation of assumptions.

Actuarial model controls

Actuarial models estimate premium adequacy, policyholder liabilities, solvency requirements and profitability. Model controls should address data quality, model versioning, assumption approval, change management, independent validation, access security and documentation. The appointed or responsible actuary must be able to explain material assumptions and the effect of changes in those assumptions.

A model may be mathematically sophisticated yet unreliable if its data are incomplete or its assumptions are unsuitable. Controls should therefore reconcile model inputs to source systems, investigate missing or abnormal data, preserve reproducible runs and require approval for overrides. Sensitivity and scenario analysis can reveal how results change under alternative claim inflation, lapse, mortality, catastrophe or interest-rate assumptions.

Financial reporting controls

Financial reporting controls include account reconciliations, journal-entry approval, chart-of-accounts governance, closing checklists, consolidation controls, disclosure review and access management. Insurance-specific controls should connect policy, claims, reinsurance, investment and actuarial systems to the general ledger.

The finance function should investigate unreconciled items rather than merely carry them forward. Management review controls must specify what is reviewed, by whom, with what evidence and how exceptions are resolved. A control that consists only of a manager signing a report, without evidence of the review performed, may not demonstrate effective operation.

Fraud Risk and the Control Response

Fraud is an intentional act involving deception to obtain an unauthorized or illegal benefit. It may be committed by employees, policyholders, intermediaries, service providers, management or colluding parties. The fraud triangle identifies pressure or incentive, opportunity and rationalization. Strong governance reduces opportunity, but performance pressure and ethical culture also require attention.

Insurance fraud may involve fabricated policies, false claims, premium diversion, commission manipulation, procurement misconduct, insider trading, unauthorized investments, concealment of adverse actuarial results or financial statement management. Fraud risk assessment should be continuous and linked to data, complaints, whistle-blower reports, control exceptions and regulatory findings.

An effective response includes preventive controls, confidential reporting channels, investigation protocols, preservation of evidence, disciplinary procedures and appropriate regulatory reporting. Anti-fraud programs must respect due process and data-protection requirements. Aggressive fraud screening that unfairly rejects legitimate claims can create conduct and discrimination risks.

Taxation and Insurance Financial Management

Taxation is jurisdiction-specific, and insurers must follow the law applicable to their country, legal form, products and transactions. Nevertheless, several general principles are widely relevant. Taxable income may differ from accounting profit because legislation may prescribe different rules for premium recognition, claims deductions, reserves, investment income, expenses, reinsurance and capital gains.

A tax reconciliation explains differences between accounting profit and taxable profit. Temporary differences may create deferred tax assets or liabilities when the accounting carrying amount of an asset or liability differs from its tax base. Recognition of deferred tax assets commonly depends on whether future taxable profits are probable under the applicable accounting framework.

Insurance taxation may involve corporate income tax, value-added or premium-related taxes, withholding taxes, payroll taxes, stamp duties and taxes on investment transactions. Product pricing must consider the tax treatment of premiums, commissions, benefits and policyholder claims. Tax uncertainty should be identified, documented and escalated rather than treated as a purely technical issue.

Tax governance includes a documented tax strategy, defined responsibilities, review of uncertain positions, timely filing, reconciliations, retention of evidence and oversight by senior management or the audit committee. Tax planning must distinguish lawful planning from concealment or evasion. Transactions lacking commercial substance, artificial transfer pricing or inaccurate claims for deductions can expose the insurer to penalties, interest, reputational harm and loss of licence.

Governance, Fiduciary Duty and Accountability

Corporate governance is the system by which an insurer is directed, controlled and held accountable. The board is responsible for setting strategic direction, approving risk appetite, overseeing management and ensuring that the insurer has adequate resources and controls. Directors have duties of care, diligence, loyalty and proper purpose, subject to the law of the relevant jurisdiction.

The board should understand the insurer’s risk profile sufficiently to challenge management. It cannot transfer its accountability to consultants, auditors or actuaries. At the same time, effective oversight does not require directors to perform operational tasks. The appropriate balance is informed challenge, clear delegation and reliable reporting.

An audit committee generally oversees financial reporting, internal and external audit, significant estimates, control deficiencies and auditor independence. A risk committee may oversee underwriting, catastrophe, market, credit, liquidity, operational and emerging risks. A remuneration committee should ensure that incentives do not reward premium growth, claim denial or investment risk without regard to long-term outcomes. A nomination or governance committee may address board competence, succession and evaluation.

Fiduciary thinking is particularly important because insurers manage funds that policyholders may need after death, illness, accident or catastrophe. Decisions that maximize short-term shareholder returns at the expense of claims-paying capacity may be financially and ethically unacceptable. Governance reports should therefore communicate solvency, liquidity, risk exposures, related-party transactions, control weaknesses and material uncertainties with sufficient clarity.

Ethics and Professional Conduct

Ethics concerns the quality and fairness of decisions, not merely their legal form. Insurance professionals face conflicts involving sales targets, claims settlement, commission, pricing, personal investments, related parties, confidentiality and disclosure. A decision may be technically permitted yet inconsistent with duties of fairness, transparency or stewardship.

Core professional values include integrity, objectivity, competence, confidentiality and responsible conduct. An actuary should not manipulate assumptions to meet a desired result. An auditor should not overlook a material issue because of pressure to retain a client. A claims manager should not delay a valid settlement to improve quarterly results. A director should disclose a personal interest and abstain from decisions where appropriate.

Ethical decision-making can be structured through five questions: What facts are known and what remains uncertain? Who will be affected? What duties and rules apply? Which alternatives are fair and defensible? Would the decision remain acceptable if disclosed publicly? Documentation of reasoning is important because accountability concerns both the decision and the process by which it was reached.

Disclosure quality is an ethical and governance issue. Complex explanations should not be used to obscure uncertainty. Users need understandable information about assumptions, sensitivity, concentration, liquidity, related parties, reinsurance dependence and significant judgments. Transparent disclosure does not mean disclosing every internal document; it means presenting material information accurately, neutrally and in a form users can understand.

Technology, Data and Emerging Assurance Practices

Digital underwriting, automated claims, cloud platforms, robotic process automation and machine-learning models can improve speed and consistency. They also introduce risks involving cybersecurity, privacy, model bias, data lineage, vendor dependence and unauthorized access. An automated decision remains a management decision for governance purposes.

Technology controls include identity and access management, segregation of duties, change approval, backup and recovery, incident response, interface reconciliation, vulnerability management and logging. Continuous auditing can use full-population data to identify unusual journals, duplicate claims, limit breaches and breaks between operational and financial systems. However, dashboards can create false confidence if data definitions, thresholds and escalation procedures are unclear.

AI models require additional governance. The insurer should document the purpose of the model, training data, performance metrics, explainability, human review, drift monitoring and prohibited uses. Sensitive decisions such as claims denial or pricing should have appropriate oversight and an appeal mechanism. A model’s predictive accuracy does not by itself establish fairness, legality or suitability.

Illustrative Case: Meridian General Insurance

Background

Meridian General Insurance, a fictional mid-sized insurer, expanded rapidly through digital motor and health products. Premium revenue increased substantially, but the company also introduced aggressive performance bonuses based on quarterly growth. Its policy administration, claims and finance systems were connected through automated interfaces.

Situation and problem

Near year-end, internal audit identified three concerns. First, a large number of policies had been backdated and later cancelled. Second, claims reserves for a new health product were materially lower than those produced by an independently run actuarial analysis. Third, the investment department had exceeded a concentration limit through purchases made near the reporting date. The chief financial officer argued that the differences were temporary and that disclosure could alarm investors.

Analysis

The backdated policies created cut-off and occurrence risks and could have inflated premium income. The low reserves raised valuation and completeness concerns because early claims experience was worse than assumed. The investment breach indicated a failure of mandate monitoring and possible governance weakness. The incentive system created pressure, while weak access controls allowed operational staff to alter dates and reserve fields. The audit committee also discovered that management had not documented its review of actuarial assumptions.

Approach and solution

The board chair requested an independent investigation. Finance froze manual changes to policy dates and reserves except through documented approvals. The company reconciled policy records, collections and cancellations, and performed expanded testing of claims incurred before year-end. An external actuarial specialist reviewed data, assumptions and model implementation. The investment committee required an immediate limit-breach report, independent valuation and a remediation plan.

Management corrected material misstatements, reassessed deferred tax effects, revised performance measures and notified the regulator where required. The audit committee required quarterly reporting on model changes, control exceptions and unresolved reconciliations. Meridian also introduced a speak-up channel, separated claims approval from payment release and subjected the new digital model to bias and performance testing.

Outcome

The final financial statements reported lower premium profit and higher claims liabilities than the preliminary figures. Although the correction reduced short-term reported earnings, it improved the reliability of solvency information and restored confidence among the board, regulator and major policyholders. The revised incentive plan incorporated persistency, claims quality, customer outcomes, capital adequacy and control performance rather than growth alone.

Learning points

The case demonstrates that audit findings often reflect interconnected failures rather than isolated errors. Incentives, access rights, actuarial governance, investment limits and disclosure decisions must be considered together. Early escalation is less costly than concealment. Independent challenge is effective only when the board supports it and management acts on evidence.

Challenges, Limitations and Best Practices

The principal challenge in insurance assurance is uncertainty. No control can predict every catastrophe, market movement or fraudulent scheme. Actuarial estimates will change as experience develops, and a clean audit opinion does not guarantee future solvency. Boards must therefore avoid treating compliance as a substitute for judgment.

Common mistakes include excessive reliance on checklists, failure to investigate recurring exceptions, inadequate documentation of management review, poor segregation of duties in small branches, treating internal audit as an operational department, and assuming that an automated process is inherently controlled. Other failures include using performance measures that reward harmful conduct, ignoring tax uncertainty, approving related-party transactions without independent review and publishing disclosures that are technically complete but practically incomprehensible.

Best practice requires a risk-based control framework, clear accountability, independent challenge, reliable data lineage, regular scenario analysis, timely remediation and a culture in which bad news can be reported without retaliation. The board should receive information that is concise enough to use but sufficiently detailed to support challenge. Control effectiveness should be assessed not only by whether a procedure exists, but by whether it prevents or detects a material risk in practice.

Chapter Summary

Audit, internal control, taxation, ethics and governance form an integrated foundation for trustworthy insurance management. Auditors assess risks, assertions, evidence and estimates, while internal controls govern underwriting, claims, investments, actuarial models and financial reporting. Fraud prevention requires attention to incentives, opportunity, data and culture. Tax governance reconciles accounting and taxable results and ensures that planning remains lawful and transparent.

Boards and committees provide oversight but cannot delegate accountability for strategy, risk appetite, reporting and policyholder protection. Ethical conduct requires integrity, objectivity, fairness and clear disclosure of uncertainty. Technology and AI improve monitoring and efficiency but introduce risks involving cybersecurity, privacy, bias and model governance. Effective insurers combine independent assurance, disciplined controls, responsible incentives and transparent decision-making.

Key Terms

Audit evidence: Information used by an auditor to support conclusions and an audit opinion.

Assertion: A management claim about a transaction, balance or disclosure, such as completeness or valuation.

Internal control: Processes designed to provide reasonable assurance over operations, reporting and compliance.

Materiality: The significance of an omission or misstatement to users’ decisions.

Professional scepticism: A questioning attitude and critical assessment of audit evidence.

Actuarial model: A mathematical model used to estimate liabilities, premiums, risks or solvency.

Model risk: The possibility that a model is unsuitable, incorrectly implemented or misused.

Claims reserve: An estimated liability for claims that have been incurred but not fully paid or settled.

Segregation of duties: Allocation of incompatible responsibilities among different individuals or units.

Fraud triangle: The interaction of pressure, opportunity and rationalization that may support fraud.

Taxable income: Income calculated under applicable tax law rather than necessarily under accounting standards.

Temporary difference: A difference between an asset or liability’s accounting amount and tax base that may reverse later.

Deferred tax: Tax effect recognized for temporary differences under the applicable accounting framework.

Fiduciary duty: A duty to act with loyalty, care and good faith for those whose interests are entrusted to the decision-maker.

Audit committee: A board committee overseeing financial reporting, audit and significant control matters.

Risk appetite: The amount and type of risk an organization is willing to accept in pursuing objectives.

Professional ethics: Principles governing integrity, objectivity, competence, confidentiality and responsible conduct.

Continuous auditing: Use of technology and recurring analysis to evaluate transactions and controls continuously or frequently.

Model governance: Policies and controls governing model development, validation, use, change and monitoring.

Disclosure quality: The accuracy, relevance, neutrality, clarity and completeness of information provided to users.

Review Questions

Short Answer Questions

1. What is the difference between internal audit and external audit?

2. Why is completeness a significant assertion for claims liabilities?

3. State two controls applicable to investment operations.

4. What is meant by a temporary tax difference?

5. Identify two ethical values relevant to insurance professionals.

Long Answer Questions

1. Explain how internal controls should be designed across underwriting, claims, investments, actuarial models and financial reporting.

2. Discuss the nature and reliability of audit evidence in an insurance company.

3. Examine the responsibilities of the board, audit committee, risk committee and senior management.

4. Explain how accounting profit may differ from taxable income and describe the elements of tax governance.

5. Discuss the ethical and governance risks associated with automated underwriting and claims models.

Analytical / Application Questions

1. An insurer reports unusually high premium growth because policies were issued near year-end and many were cancelled shortly afterward. Identify the assertions, fraud risks and audit procedures that should be considered.

2. An actuarial model produces lower liabilities after management changes several assumptions but cannot provide a documented rationale. Evaluate the control weaknesses and propose a response.

3. A board is informed that an investment concentration limit was breached but delays disclosure until after a capital raising. Analyse the governance, ethical, reporting and regulatory implications.

22. Multiple Choice Questions with Answers

Question 1

Which audit assertion is most directly threatened when claims incurred before year-end have not yet been recorded?

A. Completeness

B. Existence

C. Rights and obligations

D. Classification

Correct Answer: A. Completeness

Question 2

Which arrangement best demonstrates segregation of duties in investment operations?

A. One manager initiates, settles and records every trade

B. The dealing function is separate from custody and settlement functions

C. The board approves every individual transaction

D. The external auditor executes investment reconciliations

Correct Answer: B. The dealing function is separate from custody and settlement functions

Question 3

A difference between accounting profit and taxable profit that is expected to reverse in a later period is generally called a:

A. Permanent loss

B. Temporary difference

C. Control deficiency

D. Capital requirement

Correct Answer: B. Temporary difference

Question 4

Which factor is not one of the traditional elements of the fraud triangle?

A. Pressure or incentive

B. Opportunity

C. Rationalization

D. Actuarial certification

Correct Answer: D. Actuarial certification

Question 5

What is the most appropriate response when an insurer’s actuarial model has changed without documented approval or validation?

A. Accept the result because the model is automated

B. Use the result if it increases reported profit

C. Investigate the change and obtain independent review and validation

D. Delete the prior model and remove the audit trail

Correct Answer: C. Investigate the change and obtain independent review and validation

Question 6

Which responsibility cannot be transferred by a board to an external auditor?

A. Obtaining an independent audit opinion

B. Performing specialist valuation procedures

C. Overall accountability for governance and oversight

D. Confirming selected investment balances

Correct Answer: C. Overall accountability for governance and oversight

Question 7

Why may a small misstatement still be material to an insurer?

A. All small errors are automatically material

B. It may conceal a regulatory capital breach or change a reported loss into profit

C. Auditors are required to report every immaterial error as fraud

D. Insurance statements contain no estimates

Correct Answer: B. It may conceal a regulatory capital breach or change a reported loss into profit

Question 8

Which control most directly addresses unauthorized changes to claims reserves?

A. Allowing unrestricted access to reserve fields

B. Removing all reserve documentation

C. Access restrictions, approval requirements and an audit trail

D. Paying all claims immediately

Correct Answer: C. Access restrictions, approval requirements and an audit trail

Question 9

What is a key governance concern when AI is used to deny claims?

A. The model eliminates the need for human accountability

B. Predictive accuracy alone proves fairness and legality

C. Bias, explainability, data quality and appropriate human review must be addressed

D. The insurer no longer needs a claims policy

Correct Answer: C. Bias, explainability, data quality and appropriate human review must be addressed

Question 10

Which incentive system is most consistent with sound insurance governance?

A. Rewarding only quarterly premium growth

B. Rewarding claim denials regardless of validity

C. Linking rewards to growth alone without capital measures

D. Considering customer outcomes, claims quality, capital adequacy and control performance

Correct Answer: D. Considering customer outcomes, claims quality, capital adequacy and control performance