Coverholder audit scope Questions. version 2

Transcription

1 Coverholder audit scope Questions version 2 6 February 2014

2 coverholder AudIT SCOPE DRAFT V1.35 Key Contacts Delegated Authorities Team General enquiries: +44 (0) Systems help: +44 (0) Disclaimer No responsibility of liability is accepted by the Society of Lloyd s, the Council, or any Committee of Board constituted by the Society of Lloyd s or the Council or any of their respective members, officers, or advisors for any loss occasioned to any person acting or refraining from action as a result of any statement, fact, figure or expression of belief contained in this document or communication. The views expressed in the paper are Lloyd s own. Lloyd s provides the material contained in this document for general information purposes only. Lloyd s accepts no responsibility, and shall not be liable for any loss which may arise from reliance upon the information provided.

3 coverholder Audit SCOPE V2 Questions 1 INTRODUCTION The purpose of this document Changes in this version 4 2 GENERAL Atlas information review The company Accounts IT Business continuity Compliance with applicable laws and regulations Financial Crime 11 3 CONTRACT SPECIFIC Underwriting Claims Transactional accounting Reporting General 18 4 APPENDICES Appendix One Atlas information review Appendix Two Cross border risks Appendix Three Local tax payments made by the coverholder Appendix Four Internet trading Appendix Five Consumer business Appendix Six Certificate checklist Appendix Seven Full claims questionnaire Appendix Eight Short claims questionnaire Appendix Nine File audit checklist for claims Appendix Ten Transactional accounting 31 3

4 coverholder Audit SCOPE V2 Questions 1 Introduction 1.1 The purpose of this document A common audit scope has been compiled with the intention of improving consistency of audits and the audit process, so making it easier for coverholders to work with the Lloyd s market and to support both managing agents and coverholders in meeting the expectations of the Prudential Regulatory Authority (PRA) and the Financial Conduct Authority (FCA). Whilst the use of this Audit Scope is not mandatory, and in certain situations a bespoke scope may be appropriate, it is intended that managing agents should as far as possible use this scope in order to reduce duplication and to promote consistency. 1.2 Changes in this version The audit scope has been completely revised to take account of recent changes such as new technology and regulatory requirements. The audit scope has also been given a whole new look and feel. The audit scope has been split into two main sections, a general section and a contract specific section. Significant changes have been made to the underwriting and claims management sections and questions as it is expected that there will be a greater focus on these. Appendices have been introduced for Internet Trading, Consumer Business, Claims Audits and an Atlas Information Review. A separate accompanying document Coverholder Audit Scope Guidance Notes provides guidance on these questions. It is recommended that the guidance notes are read by all parties involved in the audit prior to any audit planning or audits taking place. This document lists the questions to be asked by external auditors undertaking audits of coverholders on behalf of managing agents in the Lloyd s market. The questions below are a generic group of questions to ensure that key topics and areas are covered by the audit. The managing agent is expected to select the questions and sections they would like asked from the list given, see section 1.9 of the Guidance Notes. In some regions and for some classes of business there may be additional topics which need to be examined, it is expected that the auditor and managing agent will discuss and agree these in advance of the audit. For many of the questions specified in the audit scope below, the auditor is expected to test and provide evidence where appropriate, unless instructed not to by the managing agent. For example by:- Reviewing files, transactions, logs and examples. Looking at what has been documented and reported. Testing understanding, by asking if this happened what would you do? Requesting copies of documentation and examples as evidence where appropriate. It is expected that the auditors will comment on the areas that they have tested and reviewed for the managing agents to take the appropriate action. This document is not concerned with self-certification by coverholders or audit co-ordination; these will be addressed by separate initiatives; however, it is hoped that the production of this document will assist with these. 4

5 2 General 2.1 Atlas information review 2.1 Atlas information review Q1 If the managing agent has requested that the auditor undertake a review of the information on Atlas, then complete Appendix One. 2.2 The company People Q2 Provide details of who is responsible for managing the coverholder and any succession plans. Q3 In the legal entity with which the managing agent has the contract How many staff are there now? How many staff were there last year? What is the total level of staff turnover this year? What was the total level of staff turnover last year? Q4 Provide details of staff training. Include comments on:- Induction programmes for new staff. Which staff receive training? Training and education for underwriters and claims handlers. Any changes to the training programme in the last twelve months. Q5 Test the evidence that training has taken place, for example by reviewing examples of attendees at training sessions and materials used; and asking questions to check whether staff understand key processes and procedures. Q6 EU (including the UK) only: Does the operation of this binding authority contract present Lloyd s syndicates with a potential exposure to Transfer of Undertakings (Protection of Employment) regulations - TUPE? If so provide details Multi Office locations (if applicable) Q7 Explain how consistency is ensured between offices and any central controls in place. Q8 How is home-working / remote working controlled? Provide details of the controls and list any authority holders who work from home or remotely. Confirm that any remote workers have completed and signed a remote worker form. Q9 Test and provide evidence of how consistency, of each of the relevant areas of the audit scope, between multi office locations is managed, for example by looking at samples of files and reports and control or audit logs Outsourcing, insourcing and producers Q10 Provide details of the coverholder s outsourcing arrangements and any activities which are insourced, that is provided by a different company or division within the same group of companies, for example. Q11 Provide details of any call centre arrangements including how they are controlled. Include comments on:- Whether the calls are scripted. Whether the calls are advised or non-advised. Details of the training that employees receive. Which staff receive training. Whether the coverholder provides on-going training. How the coverholder monitors calls. Whether call audits are carried out, the frequency of these and how the calls to be reviewed are selected. What the coverholder does with the results, and whether these are reported to management on a regular basis. Details of the actions that a coverholder takes if a call is not satisfactory. Q12 Describe how the coverholder manages their external producers. Include comments on:- How the coverholder monitors external producers. Details of any regular vetting or monitoring. Any processes to check that due diligence has been done. Validate that the correct licences are in place for their producer agreements. The process to end relationships with external producers including details of any documentation such as TOBAs. Where the coverholder has a network of producers bringing business in on a non-inclusive arrangement, validate that there is a document of the arrangement such as a TOBA. Q13 Test and provide evidence of how outsourcing and insourcing arrangements and producers are being managed, for example by reviewing call scripts, training plans, recordings of calls and action logs. 5

6 2.2.4 Conflicts of interest Q14 Provide details of any actual and potential conflicts of interest which relate to the binding authority contract(s). Q15 Provide details of how the coverholder manages conflicts of interest which relate to the binding authority contract(s). Include comments on:- How they identify conflicts. How they resolve conflicts. How they manage conflicts. Any changes to the process in the last twelve months. Attach any relevant documentation relating to identifying, resolving or managing conflicts of interest. Q16 Provide details of any member of the senior management who has a financial interest in any other entity within the insurance industry. Q17 If any producers provide 10% or more of the coverholder s turnover with respect to the binding authority contract(s) then provide details of these. Q18 Does the coverholder offer any staff incentives, individual profit commission arrangements or reward schemes? If so provide details. Q19 Test and provide evidence of how conflicts of interests are being avoided, identified, resolved and managed, by reviewing examples of logs and incidents and asking questions to test understanding of what represents a conflict of interest Litigation and formal investigations Q20 Provide details of Any formal investigation by an Insurance Department, Federal entity or other local regulatory or tax authority; of the coverholder. Any involvement in any litigation. Comment on whether these may be material to the coverholder s on-going operation and suitability. It is recognised that coverholders may not be able to disclose full details Errors and omissions Q21 Provide details of any claims or notifications made against the coverholder s Errors and Omissions (E&O) policy in the last three years. Include details of the current status, outstanding reserve amount, and brief circumstances of the claim notification. Q22 Provide details of any attempts to renew E&O cover which have been declined by an insurer. It is recognised that coverholders may not be able to disclose full details. 2.3 Accounts Fund accounts Q23 Provide details of how premium accounts and claims loss funds are held. Include comments on:- Whether these are in accordance with the binding authority contract; and if not details of the reasons why not. Whether insurance accounts and loss funds are segregated from company operating accounts. Whether the coverholder has a no off-set letter from their bank. Any changes made in the last twelve months to the operations and handling of accounts. Q24 Provide details of how any insurer s monies are invested. Include details of Any of the managing agent s money placed in interest bearing accounts or similar. What happens to the insurer s monies before they are given to the insurer? Q25 Provide details on how bank accounts holding Lloyd's insurance funds are guaranteed. Q26 Provide details of the process for authorising transactions. Include comments on:- Who holds the authority to authorise payments? Whether there is a dual signatory process on all outgoing transactions from the bank accounts. Q27 Provide details of the processes for reconciliation. Include comments on:- How are premium accounts and claims loss funds reconciled to bank statements? Any regular reconciliation of the segregated banking account containing Lloyd s monies conducted by the coverholder. Obtain copies of the last reconciliations for each account and ensure there are no material or unusual reconciling items. If there are, then provide details of these. The level of unallocated cash. Any suspense accounts. The process for matching cash and debit notes, and the effectiveness of this. Any changes to the process in the last twelve months. Q28 Test and provide evidence of how fund accounts are managed by reviewing samples of files, transactions, logs and statements; and by asking questions to check understanding of the processes in place. 6

7 2.3.2 Credit control Q29 Provide details of the coverholder s process for managing aged debt. Include comments on How frequently aged debt is monitored. Describe the level of detail and accuracy of aged debt monitoring including whether the amounts reported and the overdue periods reported are accurate. Review and comment on the latest aged debt reports. Any changes to the process in the last twelve months. Q30 Describe how the coverholder moves insurance funds between accounts. Q31 Provide details of any times when the coverholder appeared to suffer a prolonged period of cash flow adversity. Explain why this occurred and the outcome. Q32 Test and provide evidence of how credit control is being managed, for example by: Reviewing samples of files, transactions, logs and statements. By asking questions to check understanding of the processes in place Taxes and regulatory Q33 Confirm that the coverholder is only writing business in territories in accordance with Lloyd s authorised territories for the coverholder as shown on Atlas, and as agreed for the binding authority contract in question. Review the binding authority contract to understand the territories in which the coverholder is allowed to write. Provide details of the coverholder s procedures and any discrepancies between these and the binding authority contract. Ask questions to test the understanding of these policies by the coverholder s staff. Review internal training plans or circulars or similar. Test a sample of risks, check the details and location of the insured and the risk and the information held on the transactions. Provide details of findings including any discrepancies. Q34 Confirm that the managing agent s current risk assessment of the coverholder s business for collecting and processing tax and regulatory information is in line with what is actually found. Q35 Provide details of how the coverholder determines the location of risk and the relevant taxes and regulations to apply. Include comments on:- The information which the coverholder captures to determine the insured s domicile, the risk location and the location(s) of the subject of the insurance. How the coverholder determines, applies and records the location of the risk and the insured from a tax and from a regulatory perspective. How the information used to determine risk locations from a tax and regulatory perspective is maintained and updated. How the coverholder determines and applies the taxation requirements and the tax liabilities for the insured and the insurer. Whether the coverholder s controls are adequate to determine whether the risks being written are cross border risks (see Q37 below). Whether the coverholder uses Crystal and the Risk Locator tools; how and when in the process they are used and what evidence of checks is retained. If Crystal and the Risk Locator tools are not used, then describe how the coverholder determines the tax rates applicable to any given risk; and how this source of information is maintained and updated; and what records are maintained as evidence of how the rates were determined. How tax issues are resolved, for example where there is conflicting advice. Comment on any changes made in the last twelve months. Q36 Test and provide evidence of how the coverholder determines the location of risk and relevant taxes and regulations by:- Asking questions to test the understanding of staff to test understanding and usage of processes and procedures. Reviewing internal training plans or circulars or similar. Take a sample of risks, apply the coverholder s processes and procedures and compare the results to, for example; the details recorded on the invoice, the coverholder s system and reports to managing agents. Look at Crystal and the Risk Locator Tool to decide whether they think that the location(s) identified are correct. Comment on any discrepancies or errors found. For coverholders which are identified as higher risk, or writing cross border risks, the auditor should check at least three transactions for each territory and class of business and the managing agent may also ask the auditor to review such transactions against Lloyd s Control Framework Data Items:- 7

8 2.3.3 Taxes and regulatory Q37 A cross border risk is one where either:- The insured is domiciled in a different country or state or province to the coverholder or where different regulatory controls are in operation. The subject of the insurance is located in a different country or different state or province to the coverholder or where different regulatory controls are in operation. The subject (or any part) of the insurance is located in more than one country, state, province or location where different regulatory controls are in operation. If the coverholder binds cross border risks on the binding authority contract being audited, which are located in a different country to the coverholder, or where multiple risk locations apply; then answer the questions in Appendix Two. Q38 Describe any regulatory location or tax information which the coverholder reports to the managing agent. Include comments on:- Whether or not the coverholder has been asked by the managing agent(s) to produce such reports. Whether the managing agent(s) have specified particular formats. How the coverholder substantiates, assesses and records the location of risk to meet tax and regulatory reporting requirements. Whether entries in the reports are sent to the managing agent(s) in accordance with the managing agent(s) requirements. Whether reports include both the insured s domicile and the regulatory domicile. Whether information is being reported at a transactional or summarised level. Whether all data is correctly stated in each case. Whether the coverholder uses an automated system or a manual re-keying process to enter the tax and regulatory information in the reports. Q39 Test any regulatory and tax reports by comparing what is on the reports to what is on the underwriting files, claims files and bank accounts. Q40 Validate and provide evidence that relevant local taxes are being paid, accurately and in a timely manner to the correct body or forwarded on to the underwriter for settlement in accordance with regulations. Detail the process the coverholder uses to make returns to relevant local authorities. Provide details of evidence of this including details of the frequency and accuracy of reports. Provide evidence for local tax payments by completing a table similar to that shown in Appendix Three. Q41 Validate and provide evidence that fees and charges are clearly disclosed to the insured(s) and underwriter(s). Q42 Provide details of where taxes are being settled by any party other than the coverholder. For example, by retail brokers or producers. Comment on: Whether the coverholder holds any records of this tax. How the coverholder satisfies themselves that this tax is settled. Test and validate by obtaining evidence of the tax settled by other parties on a sample basis. Q43 Provide details of how the processes described above are monitored and managed. Who checks that the correct taxes have been applied? The quality control procedures in place to validate the entries before reports are released. Where the reports are manually compiled, whether the entries validated against any system reports or other data. What proportion of the risks are checked separately when carrying out quality control checks. What system control reports are run to reconcile the information within the underwriting systems, financial systems, reports and bordereaux submitted to the managing agents; to ensure that all risks and transactions are reported? Q44 Provide details of any reviews of the coverholder by local regulators or tax authorities. What was the conclusion? Was any resultant action taken? 2.4 IT IT Systems Q45 Provide details of any system(s) which are used by the coverholder to process business under the binding authority contract. Include comments on:- How system(s) are supported and maintained. For each system, state the name of the system and the vendor. For each system, provide details of when software was last upgraded. Q46 Provide details of any ESCROW agreements (any agreements where relevant software source code is lodged with an independent third party) are in place for the main software system(s) in case the vendor fails. Q47 Provide details of any problems which the coverholder s systems have had in the last year which have resulted in downtime of more than half a day. 8

9 2.4.1 IT Systems Q48 Provide details of any systems which the coverholder has which are hosted in the Cloud or by a third party. Include comments on:- Any Service Level Agreements (SLAs) in place. Any security in place. Q49 Provide details of the coverholder s anti-virus and anti-spam protection that is in place for the network including servers and workstations. Include comments on any changes made in the last twelve months. Q50 Provide details of the coverholder s policies on the use of own devices (staff private devices such as tablets or smart-phones) and the security policy in place for these. Include comments on any changes made in the last twelve months. Q51 Describe back up procedures for internal systems and for external web based services. Include comments on:- How often system back-ups are performed. Whether back-ups are partial, incremental or full back-ups. Where back-ups are stored. If there is a written policy for back-ups. Q52 Test and provide evidence of how IT systems are being managed, for example, by reviewing any logs, reports, SLA documentation and samples of policies and by asking questions to check understanding of processes and procedures Data Protection Q53 Describe how the coverholder complies with relevant data protection laws in its territory and for the UK. Include comments on:- The steps undertaken to ensure that all data is kept securely. The controls in place. Data retention and general information security procedures outside of personal data, for example confidential information. Q54 If there are branch offices, provide details of how data is transferred between offices and how it is secured. Provide details of the processes for home workers/branch offices and those with remote access. Q55 Provide details of any data security breach in the last twelve months. Q56 Provide details of any system(s) penetration tests which have been performed in the last twelve months. Q57 Provide details of any policies governing the management of passwords including password length, format, expiry, use of unique user IDs and user lockout. Q58 Where credit card payments are being taken, comment on whether the coverholder adheres to the Payment Card Industry Data Security Standards in terms of how the information is stored etc. Q59 Test and provide evidence of how the coverholder is managing data protection, for example, by reviewing the data protection policy, samples of logs, reports, and transactions and by asking questions to check understanding of processes and procedures Internet Q60 If the coverholder has a website, which allows trading, quoting or binding then answer the questions in Appendix Four. 2.5 Business continuity 2.5 Business Continuity Q61 Provide details of the coverholder s processes for business continuity including a copy of the plan. Where appropriate include comments on:- How the plan covers the office, premium, people and IT. How long it will take the coverholder to resume trading if access to their offices is not possible. Where the business continuity plan is stored. When it was last tested. When the next test is planned. What the outcome of the testing was. Q62 Test and provide evidence that the coverholder has a business continuity plan in place and that this has been tested by reviewing reports of the last test and by asking questions to test understanding of the plan. 9

10 2.6 Compliance with applicable laws and regulations Compliance, general Q63 Provide details of the coverholder's overall approach to compliance. Include comments on:- Is this outsourced or managed internally? Is there a suitable internal audit resource? Is there someone with overall responsibility? Have there been any changes in the last twelve months? Q64 Provide details of the coverholder s process for training staff in compliance matters; include comments on which staff receive training. Q65 Describe processes for cascading regulation and legislation to all relevant members of staff. Include comments on:- Any relevant intranet sites, bulletins, lectures etc. Do Lloyd's market bulletins get circulated? Q66 Determine whether the coverholder has knowledge of Atlas, and how they use and update the information on the system. Q67 Determine whether the coverholder is aware of any local and UK regulations with respect to Treating Customers Fairly. (If the coverholder is one engaged in consumer business, please also complete Appendix Five, see Q74). Q68 Test and provide evidence of the coverholder s approach to compliance and compliance training, for example by: Reviewing details of training sessions held, attendees and materials. By asking questions of staff to test awareness of processes and procedures. By examining logs and records Complaints Q69 Provide details of the coverholder s complaints procedures, including copies of any written documentation. Include comments on:- What does the coverholder consider constitutes a complaint? Is the coverholder authorised by underwriters to acknowledge and handle complaints? Describe the complaints log and the level of information that is captured. Include a copy of a page of the log. Any reporting in place. Is the coverholder sending a report to the managing agent or to Lloyd s? Is a nil return being provided where there are no complaints? Any dedicated staff. Any complaints training. Is the procedure documented? If so describe how this is documented. Is the coverholder aware of the complaints protocols in their jurisdiction? Have any complaints been received in the last twelve months? If so, provide details Q70 Test and provide evidence, if such evidence exists, that the coverholder has understood and meets the local and UK regulations with respect to complaints, for example by reviewing the complaints logs and asking questions to check understanding of procedures Branding, advertising, marketing and promotional materials Q71 Has any marketing or promotional material been launched for the product(s) written under this binding authority contract? Describe any advertising which references either Lloyd s, individual syndicates or the coverholder. Provide evidence of any approval from underwriters sought for all promotional material relating to the binding authority. Provide copies of any relevant materials. Q72 Provide details of the coverholder s procedures for branding, advertising, marketing and promotional materials. Include comments on:- Any reporting in place. Any dedicated staff. Any training. Q73 Test and provide evidence that the coverholder has understood and meets the local and UK regulations with respect to branding, advertising, marketing and promotional materials by reviewing any marketing material in use and comparing any branding to guidelines. In addition: Provide details of any examples found whilst on-site of any incorrectly applied branding. Provide details of any exceptions to the existing Lloyd s rules on branding and advertising and use of the Lloyd s logo. Quotes, certificates, websites and any other marketing should be reviewed and copies provided where appropriate. 1 0

11 2.6.4 Consumer Business Q74 If the coverholder is engaged in consumer business, please also complete Appendix Five. For a definition of consumer business please see Lloyd s market bullet Y Financial Crime Anti-money laundering Q75 Provide details of the coverholder s anti money laundering (AML) procedures. Include comments on:- Whether the AML compliance requirements set by the managing agent in their risk assessment are being adhered to, particularly any additional requirements for coverholders identified as having a higher money laundering risk profile. Any reporting processes in place, including reports to the managing agent, and whether any reports have been made. Whether anyone has been assigned this responsibility and the name of the designated person to receive, consider and report on suspicious transactions. Any anti-money laundering training; and whether this includes Lloyd s anti-money laundering training. Which staff receive training? Any changes to procedures made in the last twelve months and/or any variance from the managing agent s required procedures. Q76 Test and provide evidence that the coverholder has understood and meets the local and UK regulations with respect to anti-money laundering by: Asking questions to test understanding of what money laundering is and how it can be prevented Reviewing logs and reports and taking copies of examples; or if this is not appropriate then asking about the coverholder s processes Anti-bribery and corruption Q77 Provide details of the coverholder s anti-bribery procedures. Include comments on:- Whether the anti-bribery compliance requirements set by the managing agent in their risk assessment are being adhered to, particularly any additional requirements for coverholders identified as having a higher bribery risk profile. Any reporting in place, including reports to the managing agent, and whether any reports have been made. Have there been any notifications of suspicions of bribery and how were they resolved? Whether anyone has been assigned this responsibility. Gifts and entertainments policies and procedures. Any anti-bribery training; and whether this includes Lloyd s anti-bribery training. Which staff receive training. Q78 Test and provide evidence that the coverholder has understood and meets the local and UK regulations with respect to anti-bribery by: Asking questions to test understanding of what bribery is and how it can be prevented. Reviewing logs and reports and taking copies of examples; or if this is not appropriate then asking about the coverholder s processes Sanctions Q79 Provide details of the coverholder s sanctions procedures and capabilities. Include comments on:- Whether the sanctions compliance requirements set by the managing agent in their risk assessment are being adhered to, particularly any additional requirements for coverholders identified as having a higher sanctions risk profile. Any reporting in place, including reports to the managing agent, and whether any reports have been made. Whether anyone has been assigned this responsibility. Any sanctions training; and whether this includes Lloyd s sanctions training. Which staff receive training. Whether the sanctions compliance requirements set by the managing agent are being adhered to What sanctions checks are being undertaken? For example, complete on checks made pre-bind, during the policy period, prior to a claim or return premium payment. Is the whole book sanction checked? And if so how often does this occur? Have there been any sanctions matches and what is the referral process to the managing agent? Which sanctions lists are being used for checking? Whether processes are manual or automated. Where sanctions checks are automated, provide the name of the system and system vendor being used. Have any matters of concern under these procedures been passed on to underwriters? How are false positives handled? 1 1

12 2.7.3 Sanctions Q80 Test and provide evidence that the coverholder has understood and meets the local and UK regulations with respect to sanctions; for example by reviewing logs and reports and taking copies of examples; or if this is not appropriate then by asking about their processes.. 1 2

13 3 Contract specific 3.1 Underwriting Underwriting authority Underwriting authority Q81 Is this a prior submit binder? Or a predetermined no discretion, binder? If so the managing agent should specify the underwriting questions to be answered. This may depend for example on the level of delegation and the tools and systems provided. Is there any unauthorised sub-delegation of authority noted? Please describe in detail if found Underwriting management The submission process Q82 Describe the process for risk submission including comments on:- How coverholder underwriters are assigned risks. How risks get allocated to their various markets. Any changes to the process in the last twelve months Rating Q83 What do the coverholder's underwriters use to rate risks? Include comments on:- Underwriting guides. On-line systems. In-house tools. Any changes to the process in the last twelve months Quotes Q84 Provide details of the process for quotes. Include comments on:- Documents required to quote. Whether or not the coverholder will accept partially completed applications. Confirm that any quotes made are by an authorised individual named in the binding authority contract. Supplemental or speciality applications. Any internet tools used, for example to measure crime index or distance to coast. How long are quotes valid? Any changes to the process in the last twelve months Binding risks Q85 Provide details of the process for binding a risk. Include comments on:- Documents required to bind the risk. Whether the documents are required at the time of binding or within a timeframe afterwards. Confirm that any risks bound have been made by an authorised individual named in the binding authority contract. The use of signed/dated applications and by whom. The use of previous carrier s loss record; and whether these are for valid periods (for example within the last thirty days). Any changes to the process in the last twelve months. Q86 Can underwriting staff bind risks from remote locations? If so provide details of how this is done. Include comments on:- Whether this is done autonomously or via the coverholder s network or system? Whether documentation can be printed locally or has to be done in the coverholder s office. Are there any remote workers? If so confirm that they have completed and signed a remote worker form. Any changes to the process in the last twelve months Q87 Describe the security around any certificates and policy templates whether they are securely held and who can access and amend them Post bind Q88 Provide details of the post bind process. Include comments on:- Surveys and inspection. Follow-up procedures. Target time-frames for receipt, review and auctioning of the above. The invoicing process. Is this automatic and from a system or does someone manually do it? Any changes to the process in the last twelve months. 1 3

14 Policy and endorsement issuance Q89 What is the policy/endorsement issuance process? Include comments on:- Whether insurance documents evidencing cover are issued within the coverholder s target timeframe to comply with contract certainty timeframes for document issuance. The sign-off process, and whether this is by named, appropriately licensed individuals. Any quality checks, for example spot checks on forms, endorsements and fees. How policies and endorsements are issued including whether this is done electronically, via the internet, as a PDF, as encrypted files etc. What processes are in place to ensure that the policy wordings and documents issued replicate the terms and conditions set out in the binding authority contract? Are processes and controls for the accurate and timely issuance of documentation in accordance with guidelines on current London Market principles on certificate issuance? Comment on any examples of joint certificates being issued. Ensure any master policies issued do not breach territorial or Lloyd s regulations and are in line with the expectations of the binding authority contract. Any changes to this process in the last twelve months Renewals Q90 What is the process for renewals? Include comments on:- Does the coverholder offer renewal terms in line with those provided for within the binding authority contract? How claims are reviewed for renewals. The process for tacit renewals. What local regulatory requirements are applicable for renewals, non-renewals and/or terminations? Please summarise the processes in place to ensure that these requirements are being met. Are renewals, non-renewals and terminations being addressed in a timely manner and is this evidenced in the file review? What is the process for terminating risks and did you find evidence that it was being adhered to? Any changes to the process in the last twelve months Management of underwriting processes Q91 Provide details of the process for underwriting management. Include comments on Reports produced. Peer review processes; for example, where cancellation occurs or subjectivities of underwriting have been breached. Underwriting meetings held and the frequency of the meetings. How the binders are managed and filed. Who these are made available to and how these are made available. Whether the binders are up to date in any systems. The process for ensuring transactions get attached to the correct binders. The procedures in place to ensure renewals take place on time. Procedures for managing Endts. How claims authorities are managed and whether these are correctly understood. Q92 How does the coverholder manage hit ratios? Include comments on:- New business. Renewal business. Whether the coverholder manages hit rates by producer. Whether the coverholder manages hit rates by underwriter. Q93 How does the coverholder monitor any binding authority constraints? Include comments on:- Loss ratios. Aggregates. Premium income. Exclusions. Actual GWP vs. the Binders Notifiable and Binder Income Limits. Q94 Test that the above has taken place by looking at sample logs and meeting notes. 1 4

15 Inspections and surveys Q95 Provide details of how the coverholder manages inspections and risk surveys. Include comments on:- The average and maximum number of days from policy inception for inspections and surveys to be ordered, and to be received? Who reviews the inspection/survey? The original underwriter? The assistant underwriter? Is a check done to ensure that the information in the inspection/survey matched that used to quote risks such as the application etc.? Provide details. Provide evidence of discrepancies found, recommendations made and any follow up processes to confirm the necessary actions undertaken by the insured. Are the inspections/surveys of sufficient quality and appropriateness for the size and type of risk? Provide details. If the assistant underwriter is reviewing the inspections, are these flagged up to the original underwriter if a significant discrepancy is discovered? Contract profitability Q96 Explain how the coverholder understands the profitability of the binder. Include comments on any information that the coverholder receives from the broker and others such as any third party claims administrators and whether they are aware of key metrics such as their current loss ratios Underwriting file compliance review Underwriting file compliance review Q97 Test and provide evidence of underwriting processes and procedures by undertaking reviews of underwriting files as detailed below and in Appendix Six. Q98 Provide details of the type of files in use and whether these are paper or electronic copies. Q99 What is the average number, and what is the maximum number, of days from policy inception to policy issuance? Q100 Where applicable, what percentage of the files have signed and dated applications for the original policy? Q101 Is there evidence of correct use of any terrorism rates/guidelines/forms? If so describe this. Q102 What is the average, and what is the maximum, policy fee charged? Q103 Do the fee figures shown in the policy document match those in the file? Describe evidence that the figures shown in the policy document match those in the file. Q104 Are all forms and endorsements correct? Provide details any discrepancies. Q105 Detail any discrepancies to the underwriting rules detailed in the binding authority contract. Q106 Are underwriting rates/deductibles compliant with rate scales provided (if applicable)? Detail any discrepancies. Q107 Does information within the files compare correctly to that shown on any Written Risks/Risk-Level-Data submission? Provide details of any discrepancies between the information shown on the files and on the written risk/risk level data submission. 3.2 Claims 3.2 Claims authority Q108 Does the coverholder have claims authority? If so please answer all the questions in Section 3.2 Claims. Q109 If not, what is the process used to notify and refer claims? Q110 If the coverholder does not have claims authority, the managing agent should specify the questions to be answered on claims. Q111 Ideally, all new and existing Third Party Administrators (TPAs) and coverholders with claims authorities should complete the questionnaire provided in Appendix Seven, and update this every twelve months in advance of contract review and renewal. However, any new TPA which has not handled claims for the Lloyd s market may complete the short selfassessment questionnaire in Appendix Eight Claims management Claims organisation Q112 Provide details of the way in which the coverholder manages their claims team. Provide comments on:- What is the average case load per claims handler on all contracts handled by this coverholder? How are staff workloads monitored and managed? Is performance controlled and improved upon via internal claims audit or peer review? 1 5

16 Claims Management Q113 Describe the coverholder s policy for reserving. Include comments on:- What policies and procedures are in place to control accurate and timely (30/90 day) reserving? Provide details of the reserving policy and any guidelines in place. Q114 Describe the coverholder s procedures for managing their claims files. Include comments on:- How files are diarised for review/updating and how these are maintained. The coverholder's file retention policy. How this complies with any limitation periods that apply in relevant territories. Comment on the management of claims costs. Q115 Comment on any claims backlog. Q116 Describe the coverholder s procedure for claims outside of the coverholder s coverage, reserve or loss payment authority? Describe any changes which have taken place in the last twelve months. Q117 What documented procedures encourage proactive claims adjustment? Q118 Where appropriate; provide details of the catastrophe claims handling plan. Describe any changes which have taken place in the last twelve months. Q119 Provide details of the procedures in place relative to the collection of deductibles. Describe any changes which have taken place in the last twelve months. Q120 Describe the coverholder s process for managing subrogation and salvage. Include comments on:- How does the coverholder control the pursuit of subrogation and salvage rights to maximise underwriter s recovery? Describe any changes which have taken place in the last twelve months. Q121 Test and provide evidence that the coverholder has a policy for the fair treatment of customers and that this policy is embedded throughout the company; for example by:- Asking questions to test understanding of what the fair treatment of customers means within the company by interviewing key staff to ensure appropriate understanding of the policy. Reviewing internal circulars and training plans or similar. Q122 Does the coverholder regularly produce and review treating customers fairly management information in order to monitor compliance with local consumer regulations? Q123 Provide details of the treating customers fairly management information which is collected and the process for review (this may be outlined in the coverholders treating customers fairly policy). Q124 Test and provide evidence of any regular or recent action taken in response to issues highlighted by the treating customers fairly management information. Q125 Provide details of how claim files are being closed, and validate that this is reflected on claims reports Experts Q126 Describe the coverholder s process for managing experts. Include comments on:- If experts are selected from an approved panel then provide details of the panel. How is the panel monitored? Provide details of terms of engagement in place for all experts including frequency of reporting, fee scale and billing guidelines. Any changes which have taken place in the last twelve months Denials Q127 Provide details of the coverholder s process for managing denials. Include comments on:- Does the coverholder have authority to deny claims? Comment on how denials, and the reasoning behind denials, are recorded and reported to underwriters. Any changes which have taken place in the last twelve months Claims file review Claims file review Q128 Test and provide evidence of claims processes and procedures by undertaking reviews of claims files as detailed in Appendix Nine and by asking questions to test understanding of policies and procedures,. 1 6

17 3.3 Transactional accounting 3.5 Transactional accounting Q129 Complete the table provided in Appendix Ten using the following guidance:- Field Policy # Transaction Type Transaction Number Policy Inception / Effective Date Date Policy Issued Date Booked Value Booked Date Cash received Date item reported (Submission) to Underwriters Date money paid to Underwriters Value paid to Underwriters Failed? (Y/N) Description Enter the policy number used by the coverholder which is reported to the insurer. Enter the type of transaction (new premium, returned premium, renewal, endorsement, cancellation, etc.) If there is a unique identifier for this transaction, then enter it here. This will help to identify the transaction (i.e. Endt) if required. Enter the inception date of the policy or the effective date of the transaction being reported. Enter the date that the policy was issued to the insured. Enter the date that the transaction was entered into the agent s accounting system. Enter the gross value booked into the agent s accounting system, including the currency. Enter the date that cash was entered into the agent s accounting system. Make a note if cash was received and not booked within a suitable timeframe. Enter the report month that this transaction was reported to the insurer, or, if real time data, the date the transaction was notified to the insurer/broker. Enter the date that the agent paid the insurer for this transaction. Enter the value and currency paid to the insurer. If the transaction was actioned correctly at all times enter 'N' here. If not enter 'Y'. Enter any applicable notes to support your decision. 3.4 Reporting 3.6 Reporting Q130 Describe the coverholder's understanding of the requirements to report to the Lloyd s brokers, syndicates and Lloyd s local offices. Comment on whether Lloyd s Coverholder Reporting Standards are known about and being adhered to. Q131 Provide full details of the processes and systems used to generate reports of written risks and premiums as per the requirements of the binding authority contract. Answer questions for this type of reporting. Q132 Where the coverholder is required to report on exposures, provide full details of the processes and systems used to generate reports of exposures as per the requirements of the binding authority contract. Answer questions for this type of reporting. Q133 Provide full details of the processes and systems used to generate reports of paid premiums as per the requirements of the binding authority contract. Answer questions for this type of reporting. Q134 For coverholders with claims authority, provide full details of the processes and systems used to generate reports of claims as per the requirements of the binding authority contract. Answer questions for this type of reporting. Q135 For coverholders writing UK employer s liability policies, provide full details of the processes and systems used to generate reports of UK employers liability policies. Answer questions for this type of reporting. Q136 For coverholders based in, or undertaking business in, territories where there is a requirement to report to one or more or Lloyd s local offices, provide full details of the processes and systems used to generate reports for Lloyd s local offices. Answer questions for this type of reporting. Q137 Describe the coverholder s reporting approach. Include comments on:- The format, for example, spreadsheets, XML, Word documents etc. Systems being provided by the London broker or Lloyd s syndicate to capture data. Systems and templates used to produce reports. Where reports are system generated describe any columns or other data which is added manually; and describe how these changes take place. Any in-force and any transactional reports being produced. Any summarising of data and totalling. Describe any data transformation which occurs. Describe any changes which have taken place in the last twelve months. 1 7

18 3.6 Reporting Q138 Compare what is on the reports to what is on the underwriting files, claims files and bank accounts. Does the written premium on the underwriting file(s) match the written premium on the report? Does the paid premium match the bank accounts? Do claims being reported match claims files and accounts and funds? Q139 Explain the criteria which is used to determine what appears on each report, for example the inception date, the transaction date etc. Q140 In the event that a coverholder has no transactions to declare, what do they do? Q141 Explain how, and how often, the information is provided to the Lloyd s syndicate and whether the reporting information is sent via a Lloyd s broker (or another third party), direct to the underwriter or through any additional process. Q142 What controls are in place to ensure that data does not become lost? Does the coverholder conduct sample data entry and reporting quality control checks? If so provide details, check evidence and provide examples. Q143 Confirm that the information requirements which have been agreed within the binding authority contract are being met by the coverholder. Confirm that the information is being provided in the format agreed by the underwriters within the timeframe agreed within the binding authority contract. 3.5 General 3.9 General Q144 Following the audit, provide comments on any further information or considerations for the managing agent(s). 1 8

19 4 Appendices 4.1 Appendix One Atlas information review The auditor should check the accuracy and confirm the validity of the information held on Atlas prior to the audit. Where there are discrepancies with the information held on Atlas this should be recorded and reported to the managing agent as part of the audit report. The offsite Atlas review should ideally follow the details section headings within Atlas. The following information review provides a suggested format. Company Information Check that the following information is held on Atlas Full legal name, regulator registration number (i.e. for UK FCA number) and confirm that the information is correct. Check that all locations listed in the binding authority agreement are authorised as approved coverholders on Atlas Relationships Check details of the managing agents to the binding authority contract. Classes of Business Check that all classes of business written by the coverholder under the relevant binding authority(ies) are listed as approved classes. Regions Check that all territories where it has been agreed by managing agents that the coverholder can write business within the Binding Authority(ies) are approved on Atlas. Annual Compliance Professional Indemnity Check that the annual compliance has been completed and that the next required completion date is in the future. The coverholder s professional indemnity Insurance is in date and that the errors and omissions policy ( E&O ) certificate and wording, and any other associated coverage (fidelity insurance/ D&O insurance / key man policies) are attached in the documents tab. Coverage is fit for purpose (i.e. validate the general adequacy of the cover including whether the policy covers the coverholder s Lloyd s binding Authority business activities). Any changes to the coverholder s errors and omissions policy (E&O) since the previous audit or in the past twelve months, taking into account risk limit(s) and deductible(s) (across all binding authority agreements) and provide details of any changes to the insurer, limit and expiry date of coverage. Details of any changes to the named entities on the E&O certificates. The following documents may be held on Atlas in the documents tab. Organisation chart Management structure (particularly in relation to the coverholder s binding authority business) Details of trading relationship with group companies Company Compliance Manuals (Financial Crime, Business Continuity, Treating Customers Fairly, Distance Marketing, Consumer Product Business, Complaints Handling, Notification and Reporting, Succession Plans). 1 9

20 Check that the following information is held on Atlas Bank Accounts The accounts identified on Atlas reflect the actual accounts used by the coverholder for the binding authority business. Where the coverholder is responsible for handling claims monies, whether separate bank accounts have been established. The named signatories on Atlas are the appropriate persons responsible for authorising payments. Financial Information Reports and accounts should be attached in the documents tab. The following documents may be held on Atlas in the documents tab. Licences Copies of Licences or screen captures from applicable local territory supervisory regulator websites, evidencing that correct and in-date licences that are held by the coverholder (i.e. by the company and where applicable the individuals within the company), are to be held here. The types of licences that may be shown may include authorisation to carry out the coverholder s insurance activities, data protection registration licences, regulatory statistical reporting registration, and local tax authority registration. Check that the licenses held by the coverholder in Atlas are appropriate and fit-for-purpose and remain relevant for the individuals and for the company, as applicable. Key Staff Key staff stated within the binding authority agreement(s) with CVs/resumes Key staff who work from home or remotely are listed A Lloyd s authorised remote worker form for applicable named individuals Evidence of completion of the Lloyd s financial crime module Evidence of an individual s professional qualifications Ownership Details of company ownership Documents evidencing shareholding and ownership Underwriting and Claims Reputation and Standing Check that the authority given by the binding authority is no greater than the authority shown on Atlas Any formal investigation by an Insurance Department, Federal entity or other local regulatory or tax authority Copies of the binding authority schedule may be held within the binding authority tab. 2 0