8. Market Conduct and Policyholder Protection

Introduction and Context

Insurance is a promise to provide financial protection when an uncertain event produces loss. The promise is valuable only when it is understandable, fairly sold, properly administered, and honoured in practice. Market conduct regulation therefore addresses the behaviour of insurers, intermediaries, distribution partners, claims service providers, and other participants throughout the insurance lifecycle. It complements prudential regulation: prudential supervision asks whether an insurer is financially able to meet its obligations, while conduct supervision asks whether it treats customers fairly and fulfils those obligations appropriately.

Market conduct begins before a policy is purchased and continues through product design, advertising, advice, underwriting, policy issuance, premium collection, servicing, renewal, claims settlement, complaint resolution, cancellation, and post-claim interaction. Poor conduct can cause direct financial loss, emotional harm, exclusion of vulnerable groups, reputational damage, regulatory sanctions, and loss of confidence in insurance markets. Effective policyholder protection is consequently not merely a customer-service function. It is a matter of governance, risk management, organizational culture, legal compliance, and professional ethics.

The precise rules differ across jurisdictions. Some systems rely on detailed statutes and supervisory codes; others combine general consumer law, insurance legislation, ombudsman arrangements, and principles-based supervision. Despite these differences, a common regulatory expectation has emerged: firms should achieve fair outcomes rather than merely follow formal procedures.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the meaning, scope, and importance of market conduct and policyholder protection.

2. Apply fair-treatment principles to product design, sales, disclosure, servicing, claims, and complaints.

3. Distinguish appropriate advice, information, and sales practices.

4. Evaluate the treatment of vulnerable customers and the adequacy of cancellation and redress arrangements.

5. Design governance, monitoring, and remediation measures for conduct risk.

6. Analyse an insurance conduct problem from regulatory, managerial, ethical, and customer perspectives.

The Meaning and Scope of Market Conduct

Market conduct refers to the way an insurance undertaking and its representatives behave in the marketplace and in their dealings with customers. It includes both observable actions—such as advertising, premium collection, and claims decisions—and institutional choices, such as product governance, incentive design, data use, and complaint escalation.

Policyholder protection is the broader regulatory objective of safeguarding the rights and legitimate interests of policyholders, beneficiaries, claimants, and, in appropriate circumstances, prospective customers. The term “customer” may therefore include a person who has not bought a policy but is exposed to a sales practice, as well as a third-party claimant under liability insurance.

A useful distinction is between conduct risk and conduct breach. Conduct risk is the possibility that an institution’s behaviour, processes, products, or culture will produce unfair customer outcomes. A conduct breach is an actual failure to comply with law, regulation, contract, or an accepted standard of fair treatment. An organization may have serious conduct risk even before a breach is identified—for example, where sales incentives reward volume without measuring suitability or persistency.

The customer relationship is affected by information asymmetry. Insurers understand policy wording, exclusions, actuarial assumptions, and claims processes far better than most customers. Insurance contracts may also be complex, and the value of protection is often realised only after a loss. Regulation responds to this asymmetry through disclosure, advice standards, cooling-off rights, claims rules, complaint mechanisms, and supervisory intervention.

Core Principles of Fair Treatment

Although terminology varies, fair treatment generally requires that:

• products are designed for identifiable customer needs and target markets;
• communications are clear, accurate, balanced, timely, and not misleading;
• customers receive information necessary to make informed decisions;
• advice and recommendations are suitable where advice is provided;
• products perform in accordance with reasonable customer expectations and the contract;
• claims are handled promptly, consistently, objectively, and transparently;
• customers can obtain assistance, make complaints, and secure appropriate redress;
• personal data and confidential information are handled responsibly; and
• firms identify and mitigate foreseeable harm, including harm to vulnerable customers.

These principles are outcome-oriented. A disclosure document may be technically complete yet still fail if its presentation conceals important exclusions or makes comparison practically impossible. Similarly, a claims department may have a written procedure but produce unfair outcomes if it applies unreasonable evidential demands or delays decisions without justification.

Fairness does not mean that every claim must be paid or that all customers must receive identical treatment. A valid exclusion may be applied, and risk-based pricing may be legitimate. The relevant questions are whether the term was properly disclosed, whether it is applied consistently, whether the customer could reasonably understand its effect, and whether the insurer’s conduct is proportionate and supported by evidence.

Conduct Across the Insurance Lifecycle

Product design and governance

Conduct protection begins before distribution. Product approval should identify the intended market, customer needs, benefits, limitations, significant exclusions, foreseeable misuse, distribution channels, pricing assumptions, and potential vulnerable-customer impacts. Product testing should ask whether a typical customer can understand the product, whether the cover is likely to provide meaningful value, and whether the claims process is workable.

Product governance should continue after launch. Management information may reveal unusually high cancellation rates, low claims acceptance, repeated complaints about one exclusion, or sales to customers outside the intended target market. Such evidence should trigger review, modification, suspension, or withdrawal of the product. Product oversight is particularly important where manufacturers use multiple intermediaries, affinity groups, digital platforms, or embedded insurance arrangements.

Advertising and promotion

Advertising must not create a misleading impression through exaggeration, omission, fine print, or selective presentation of benefits. Statements such as “complete protection” or “guaranteed acceptance” require careful qualification. Premium illustrations should identify material assumptions, exclusions, waiting periods, deductibles, taxes, and renewal conditions. Comparative advertising should use comparable products and current information.

The prominence and timing of information matter. A limitation disclosed only in small print after a prominent promise may not correct the overall impression. Digital marketing also raises concerns about targeted advertisements, behavioural profiling, sponsored content, and automated recommendations that may obscure the commercial purpose of a communication.

Sales, advice, and distribution

An insurer or intermediary should distinguish between providing factual information and giving a personal recommendation. Where advice is provided, the adviser should gather relevant information about the customer’s needs, circumstances, affordability, existing cover, risk tolerance where relevant, and objectives. The recommendation should be suitable, justified, and recorded.

Even where a transaction is described as “non-advised,” sales practices must not be coercive, misleading, or exploitative. The customer should understand the nature of the cover, the premium, payment obligations, significant exclusions, waiting periods, cancellation rights, claim conditions, renewal basis, and consequences of non-disclosure. Cross-selling should not result in unsuitable bundled products or duplicate cover.

Remuneration is a central conduct issue. Commission structures may encourage replacement of existing policies, unnecessary add-ons, excessive premium finance, or sales to customers unlikely to retain the product. Governance should therefore assess conflicts of interest, clawback arrangements, quality measures, persistency, complaints, cancellation, and claims outcomes—not only sales volume.

Disclosure and policy documentation

Disclosure serves three functions: it enables informed choice, defines contractual rights and obligations, and supports accountability. Important information should be provided before commitment in a form that is accessible to the intended customer. Policy documents should clearly identify the insured risk, sum insured, premium, duration, exclusions, conditions, deductibles, duties after loss, claim procedures, cancellation rights, renewal terms, and complaint channels.

Clarity is more than simple language. A document can use short sentences and still be confusing if it presents information in an illogical order. Effective disclosure uses headings, examples, summaries, definitions, meaningful warnings, and layered information. Customers should not be encouraged to waive reading or understanding of important provisions. Digital documents should be searchable, downloadable, accessible on mobile devices, and available in durable form where required.

Underwriting and policy servicing

Underwriting decisions should be based on relevant risk information and applied consistently. Questions must be clear enough for customers to answer accurately. Where a customer makes an error, the insurer should assess its materiality and the applicable legal standard rather than automatically avoiding the contract or rejecting a claim.

Policy servicing includes changes of address, beneficiaries, nominees, payment method, coverage, vehicle, occupation, or insured interest. Service requests should be acknowledged, processed within reasonable time, and recorded. Customers should receive confirmation of material changes and warnings where a requested change may reduce protection or create a coverage gap.

Automatic renewal requires particular care. Customers should receive advance notice of renewal, price changes, altered terms, and cancellation options. Renewal systems should not exploit inertia by making cancellation unreasonably difficult or by concealing material changes.

Cancellation and cooling-off

Cooling-off rights allow a customer to reconsider a purchase after receiving policy information. The period, exceptions, refund method, and treatment of cover already used should be stated clearly. Cancellation outside the cooling-off period should also be governed by fair contractual and regulatory rules. Barriers such as repeated transfers, excessive documentation, premium deductions after cancellation, or digital interfaces designed to frustrate exit can constitute poor conduct even where a formal cancellation right exists.

When an insurer cancels or avoids a policy, it should provide a clear reason, identify the effective date, explain any premium refund or outstanding amount, and inform the customer of review, complaint, or appeal options. Cancellation should not be used arbitrarily or discriminatorily.

Claims handling

Claims are the point at which the insurance promise is tested. A sound claims process provides accessible notification channels, prompt acknowledgement, clear information requirements, competent investigation, impartial assessment, regular updates, reasoned decisions, and timely payment of accepted claims.

Insurers may investigate fraud and verify loss, but anti-fraud controls must be proportionate. A claimant should not be treated as dishonest merely because documentation is incomplete or because a claim is unusual. Investigators should distinguish between evidence of fraud, negligence, non-disclosure, breach of condition, and simple misunderstanding.

A rejection letter should identify the relevant policy term, explain how it applies to the facts, distinguish established facts from assumptions, and tell the customer how to seek review or complain. Partial settlements should explain what has been accepted and what has been declined. Claims data should be monitored for inconsistent outcomes, geographic or demographic disparities, inappropriate settlement pressure, and unexplained delays.

Complaints and redress

A complaint is an expression of dissatisfaction that requires a response, whether or not the customer uses the word “complaint.” Effective complaint management provides multiple channels, accessible procedures, acknowledgement, impartial investigation, written reasons, defined response times, escalation, and recordkeeping. Staff should not be rewarded for suppressing or reclassifying complaints.

Redress may include correction of records, reconsideration of a claim, payment of contractual benefits, refund of an unfair charge, compensation for loss, apology, or remediation of a wider customer population. Individual resolution is not sufficient when the same error has affected many customers. Root-cause analysis should identify whether the problem arose from product design, training, technology, incentives, outsourcing, or governance.

External dispute resolution—such as an ombudsman, mediation service, tribunal, or court—provides an additional safeguard. Firms should cooperate with these bodies and use their decisions and thematic findings to improve controls.

Vulnerable Customers and Inclusive Protection

Vulnerability may arise from disability, illness, age, bereavement, low financial resilience, language barriers, limited digital capability, domestic abuse, cognitive impairment, or a temporary crisis. It is not a fixed identity; a person may become vulnerable because of an event or interaction.

Fair treatment does not mean making unsupported assumptions about a customer. It means identifying potential support needs, obtaining consent where information is recorded, adapting communication, allowing additional time, using alternative channels, and avoiding pressure. Staff should know how to recognise indicators while preserving dignity and confidentiality. Reasonable adjustments may include large-print documents, interpreters, assisted communication, paper alternatives, trusted-contact arrangements, or a slower claims interview.

Technology can create exclusion when services are digital-only, identity verification fails, automated decisions cannot be challenged, or accessibility standards are ignored. Inclusive design should be tested with different user groups. Decisions involving vulnerable customers require human oversight where automation may amplify error or cause disproportionate harm.

A Governance Framework for Conduct Risk

A practical conduct framework can be organized around six connected activities:

1. Identify: map customer journeys, products, channels, conflicts, vulnerable-customer risks, and foreseeable harms.

2. Assess: estimate the likelihood, severity, scale, and duration of poor outcomes.

3. Control: establish policies, approval gates, training, disclosures, quality checks, complaint controls, and technology safeguards.

4. Monitor: use indicators such as cancellation, lapse, complaint, claim repudiation, settlement time, renewal, conversion, persistency, and remediation data.

5. Challenge: require compliance, risk, internal audit, customer representatives, and senior committees to question commercial assumptions.

6. Remediate and learn: correct individual cases, compensate affected groups where appropriate, fix root causes, and verify that the solution works.

The board and senior management remain accountable even when activities are outsourced. The three-lines model can help: business functions own conduct outcomes; risk and compliance provide advice and challenge; internal audit independently evaluates governance and controls. Accountability should be supported by clear responsibilities, escalation thresholds, documented decisions, and remuneration linked to customer outcomes.

Management information should combine quantitative and qualitative evidence. A falling complaint count may indicate improvement—or that customers cannot access the complaint process. High claim acceptance may reflect good service—or weak underwriting. Metrics therefore require context, segmentation, trend analysis, sampling, and customer feedback.

Ethics, Data, and Digital Insurance

Legal compliance is the minimum standard, not the complete ethical standard. Ethical conduct requires honesty, respect, proportionality, confidentiality, avoidance of exploitation, and willingness to correct harm. A transaction may be legally defensible yet ethically questionable if it relies on customer confusion or inertia.

Digital insurance can improve access, speed, consistency, and fraud detection. Artificial intelligence may assist underwriting, pricing, claims triage, document classification, and customer support. However, automated systems can reproduce biased data, generate opaque decisions, misclassify vulnerable customers, or make it difficult to obtain explanations. Governance should address data quality, purpose limitation, privacy, cybersecurity, model validation, human review, explainability, audit trails, and customer appeal.

Personalization also creates a boundary problem. Data used to improve relevance can become a tool for discriminatory pricing or manipulation. Organizations should ask whether data use is lawful, necessary, proportionate, reasonably expected, and consistent with fair treatment.

Illustrative Case Study: The Digital Income Protection Product

Background

HarborShield Insurance launched a low-premium income protection product through a mobile application. The product promised rapid enrollment and automated claims assessment. It targeted self-employed workers and gig-economy participants. Sales increased quickly, but most customers received only a short summary before purchase.

Situation and problem

After a severe regional disruption, many customers submitted claims. A large proportion were rejected because the policy excluded losses arising from a “pre-existing inability to work” and required evidence that some customers did not know was necessary. Complaints also showed that customers believed the product covered loss of earnings caused by temporary interruption of work. Several customers with limited digital literacy could not locate the full wording or speak to a human representative.

The insurer initially argued that the exclusions were present in the contract and that the automated system had applied them consistently.

Analysis

The issue was not simply whether the wording existed. The product’s advertising emphasized rapid financial support, while the exclusion and evidence requirements were difficult to understand. The target market included customers whose income was unstable and who might have limited ability to absorb delay. The insurer had not tested comprehension, monitored vulnerable-customer outcomes, or examined the effect of automation on rejection rates. Its reliance on consistent automated decisions confused procedural consistency with fair outcomes.

Approach and solution

Senior management suspended new sales pending review. The insurer sampled rejected claims, commissioned an independent review of the wording and customer journey, and contacted affected customers. Claims were reassessed using a human reviewer where the automated classification was uncertain. Customers who had suffered loss because of unclear communication received appropriate redress under the firm’s remediation policy.

The product was redesigned with a prominent coverage example, plain-language exclusions, a pre-purchase eligibility check, alternative communication channels, and clearer evidence guidance. The firm introduced a conduct committee, monitored rejection and complaint rates by customer characteristics and channel, tested the algorithm for error and disparate impact, and changed remuneration so that sales volume no longer dominated performance assessment.

Outcome

The revised process reduced avoidable complaints and improved the quality of claim submissions. More importantly, the insurer identified that its original control framework had treated disclosure and automation as substitutes for customer understanding and judgement. The case illustrates why fair treatment must be assessed across the entire customer journey.

Learning points

First, contractual disclosure does not cure a misleading overall impression. Second, automated consistency is not equivalent to fairness. Third, product governance must consider customer capability and likely use. Fourth, complaint and claims data are sources of preventive intelligence, not merely administrative records. Finally, remediation should address affected groups and root causes, not only the customer who first raises an objection.

Challenges and Common Failures

Organizations commonly underestimate conduct risk in five ways. They treat compliance as document production rather than outcome management; measure sales more carefully than customer welfare; delegate accountability to intermediaries or technology suppliers; assume that low complaint volumes prove satisfaction; and respond to individual errors without investigating systemic causes.

Other risks include conflicted remuneration, dark-pattern digital design, unclear exclusions, excessive evidential burdens, discriminatory underwriting, poor language access, unauthorized data use, inadequate outsourcing oversight, and weak recordkeeping. A further limitation is that fairness can be context-dependent. Regulators and managers must balance contractual certainty, fraud prevention, affordability, risk pooling, privacy, and access to insurance. Transparent reasoning and evidence are therefore essential.

Best Practices for Insurers and Intermediaries

Strong organizations integrate conduct into strategy rather than assigning it solely to compliance. They define desired customer outcomes, involve customer representatives in product testing, approve products through multidisciplinary committees, train staff in judgement and vulnerability, and review incentives regularly. They provide layered and accessible information, make cancellation and complaints straightforward, and retain reliable records of advice and decisions.

They also conduct thematic reviews, analyse claims and complaint patterns, test digital journeys, oversee third parties, and maintain a credible remediation capability. Senior leaders should ask not only whether a rule was followed, but also: What would a reasonable customer understand? Who may be disadvantaged? What evidence supports this decision? If the outcome is wrong, how will the firm know and how quickly can it correct it?

Current Developments

Conduct supervision is increasingly moving toward customer-outcome regulation, product governance, fair-value assessment, and proactive intervention. Supervisors are paying greater attention to pricing practices, renewal increases, climate-related claims communication, embedded insurance, buy-now-pay-later distribution, algorithmic decision-making, cyber incidents, and the treatment of customers affected by economic hardship.

The growing use of open data, connected devices, generative AI, and real-time underwriting may improve personalization but also intensify concerns about privacy, exclusion, explainability, and unequal bargaining power. Future-ready organizations will need both technical capability and institutional humility: models must be tested, challenged, and corrected when customer reality differs from design assumptions.

Chapter Summary

Market conduct and policyholder protection govern behaviour across the insurance lifecycle. Fair treatment requires suitable products, truthful promotion, meaningful disclosure, responsible advice, accessible servicing, proportionate underwriting, prompt and reasoned claims handling, effective complaints, and appropriate redress. Vulnerable customers require adapted communication and support, not stereotypes or exclusion. Conduct risk is a governance responsibility shared by the board, management, business functions, control functions, and outsourced partners.

A mature framework identifies foreseeable harm, assesses its scale, establishes controls, monitors outcomes, challenges assumptions, and remediates both individual and systemic failures. Digital tools and artificial intelligence can improve service but must be governed for bias, privacy, explainability, security, and human accountability. The central professional test is whether the customer receives a fair and understandable outcome, not merely whether the organization can point to a procedure or contractual clause.

Key Terms

Market conduct: Behaviour of insurance firms and intermediaries in their dealings with customers and the market.

Policyholder protection: Measures safeguarding the rights and legitimate interests of policyholders, beneficiaries, claimants, and prospective customers.

Conduct risk: Risk that business behaviour or systems produce unfair customer outcomes or regulatory breaches.

Fair treatment: Treatment that is honest, suitable, transparent, proportionate, and consistent with reasonable customer interests.

Product governance: Processes for designing, approving, monitoring, modifying, and withdrawing insurance products.

Target market: Customer group for whom a product is designed and reasonably suitable.

Vulnerable customer: A customer whose circumstances or characteristics increase the risk of harm or difficulty in engaging with an insurer.

Suitability: Appropriateness of a recommendation or product for a customer’s needs and circumstances.

Disclosure: Provision of material information about cover, costs, rights, duties, and limitations.

Cooling-off period: Time after purchase during which a customer may reconsider and cancel, subject to applicable rules.

Claims repudiation: Refusal to pay a claim, usually because of an exclusion, breach, or failure to establish coverage.

Complaint: Expression of dissatisfaction requiring a response or resolution.

Redress: Remedy for customer harm, including payment, refund, correction, compensation, or apology.

Remediation: Action to correct individual and systemic customer harm and prevent recurrence.

Conflict of interest: Situation in which personal or commercial interests may improperly influence customer treatment.

Conduct indicator: Data point used to detect potential poor outcomes, such as complaints, cancellations, or claim delays.

Embedded insurance: Insurance distributed as part of another product or service transaction.

Explainability: Ability to give understandable reasons for a decision, especially an automated one.

Review Questions

Short Answer Questions

1. Distinguish prudential regulation from market conduct regulation.

2. What is meant by a target market in product governance?

3. Why is disclosure alone not always sufficient to achieve fair treatment?

4. Identify four features of an effective claims-handling process.

5. What is the purpose of external dispute resolution?

Long Answer Questions

1. Explain how fair treatment applies across the insurance lifecycle, from product design to redress.

2. Discuss the relationship between remuneration structures, conflicts of interest, and conduct risk.

3. Analyse the regulatory and ethical issues involved in the treatment of vulnerable customers.

4. Describe a conduct-risk governance framework and explain the role of management information.

5. Evaluate the benefits and risks of artificial intelligence in underwriting and claims handling.

Analytical / Application Questions

1. An intermediary sells a bundled accident policy to customers who already hold substantially similar cover. The product has high commissions and unusually high cancellation rates. Identify the conduct risks and recommend corrective measures.

2. An insurer rejects many claims using an automated system, but customers receive only generic rejection messages. Design a fairer claims-review and redress process.

3. A digital insurer makes cancellation possible only through a chatbot that repeatedly redirects customers to sales pages. Assess this practice using fair-treatment principles and propose governance controls.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes market conduct regulation from prudential regulation?

A. Market conduct concerns solvency, while prudential regulation concerns advertising.

B. Market conduct concerns customer treatment, while prudential regulation concerns financial capacity and stability.

C. Market conduct applies only to intermediaries, while prudential regulation applies only to policyholders.

D. Market conduct regulates taxation, while prudential regulation regulates complaints.

Correct Answer: B. Market conduct concerns customer treatment, while prudential regulation concerns financial capacity and stability.

Question 2

A product disclosure document lists every exclusion but places a decisive exclusion in obscure text after prominent claims of complete protection. What is the principal concern?

A. The insurer has necessarily breached solvency requirements.

B. The document is too detailed to be legally valid.

C. Technical completeness may not prevent a misleading overall impression.

D. All exclusions are prohibited in insurance contracts.

Correct Answer: C. Technical completeness may not prevent a misleading overall impression.

Question 3

Which management information would most directly indicate a possible conduct problem in a claims process?

A. The number of desks in the claims office

B. The insurer’s total investment income

C. Unexplained differences in rejection rates and settlement times across customer groups

D. The age of the insurer’s corporate logo

Correct Answer: C. Unexplained differences in rejection rates and settlement times across customer groups

Question 4

An adviser recommends replacing a customer’s existing policy without comparing benefits, exclusions, and costs. Which risk is most immediate?

A. A conflict of interest and potentially unsuitable advice

B. A failure of catastrophe modelling

C. An excess of reinsurance capacity

D. A breach of the insurer’s investment mandate

Correct Answer: A. A conflict of interest and potentially unsuitable advice

Question 5

Which is the strongest reason for monitoring complaints even when the number of complaints is low?

A. Low complaint numbers always prove that the product is fair.

B. Customers may face barriers that prevent them from complaining.

C. Complaints are relevant only to marketing departments.

D. Complaints eliminate the need for claims monitoring.

Correct Answer: B. Customers may face barriers that prevent them from complaining.

Question 6

Which response best reflects fair treatment of a vulnerable customer?

A. Automatically refusing service to avoid additional complexity

B. Assuming the customer lacks capacity without assessment

C. Offering reasonable communication adjustments while preserving dignity and confidentiality

D. Requiring the customer to use a digital-only channel

Correct Answer: C. Offering reasonable communication adjustments while preserving dignity and confidentiality

Question 7

Why is automated consistency not necessarily equivalent to fair claims outcomes?

A. Automation can apply the same flawed assumption or biased data repeatedly.

B. Automated systems cannot process any insurance claim.

C. Consistency is irrelevant to claims decisions.

D. Human decisions are always unbiased.

Correct Answer: A. Automation can apply the same flawed assumption or biased data repeatedly.

Question 8

Which action is most appropriate after discovering that an unclear exclusion affected many customers?

A. Correct only the first complaint and close the file.

B. Delete the complaint records to protect reputation.

C. Investigate root causes and consider wider remediation for affected customers.

D. Increase sales incentives to offset reputational loss.

Correct Answer: C. Investigate root causes and consider wider remediation for affected customers.

Question 9

What is the primary purpose of a cooling-off period?

A. To allow the insurer to avoid all claims during the policy term

B. To give the customer an opportunity to reconsider after receiving policy information

C. To permit unlimited premium increases

D. To replace all disclosure requirements

Correct Answer: B. To give the customer an opportunity to reconsider after receiving policy information

Question 10

Which governance arrangement best supports accountability for outsourced claims handling?

A. Treating outsourcing as a transfer of all regulatory responsibility

B. Leaving the provider’s controls entirely unexamined

C. Retaining oversight through contracts, monitoring, audits, escalation, and senior accountability

D. Measuring only the provider’s claim volume

Correct Answer: C. Retaining oversight through contracts, monitoring, audits, escalation, and senior accountability