Underwriting Cycle—P&C
COSO
Component
Cycle
Transaction
Process
Control Objective
Control
Objective
Control
Type
(CAVR)
Control
Objective
Category
(C/FR/O)
Underwriting strategy has
been clearly communicated
Control
Underwriting
Underwriting
to management and
Activities
Guidelines
personnel responsible for
underwriting decisions.
V
FR
Underwriting strategy has
been clearly documented to
provide for the consistent
Control
Underwriting acceptance of submissions
Underwriting
Activities
Guidelines that are consistent with the
company's risk tolerance,
pricing strategy and
exposure aggregation.
V
FR
3/6/2016
Risk
Point of
Focus
Control
Type
(CAVR)
Point of Focus
Underwriting guidelines
have not been effectively
Underwriting guidelines are effectively
communicated to
communicated and readily accessible by
management and personnel personnel and management responsible for
responsible for underwriting
underwriting decision making
decisions.
Underwriting guidelines are clearly to
document standard policies and procedures
related to:
* risk acceptance/decline (including loss
history review, risk surveys/loss control
Underwriting guidelines
inspections)
have not been formally
* risk pricing (including experience and
documented in sufficient
schedule credit)
detail to consistently ensure
* risk aggregation
appropriate underwriting
* lines of authority and approval process
decision with regards to risk
* contract language and provisions
acceptance, pricing and
(coverage, exclusions, etc.)
aggregation.
* reinsurance (alignment with in-force treaties
or placement of facultative)
* transaction processing (recording policy
issuance and subsequent activities as well
as other necessary functions such as
premium audits)
V
V
Page 1 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Transaction
Process
Control Objective
Control
Objective
Control
Type
(CAVR)
Control
Objective
Category
(C/FR/O)
Changes to underwriting
strategy are properly
updated in documented
underwriting guidelines.
V
FR
Management regularly
Underwriting
monitors compliance with
Guidelines
underwriting guidelines.
V
FR
Underwriting decisions are
Control
Underwriting made by suitably qualified
Underwriting
Activities
Guidelines
and experienced
underwriters.
V
FR
Control
Underwriting
Underwriting
Activities
Guidelines
Monitoring Underwriting
3/6/2016
Risk
Point of
Focus
Control
Type
(CAVR)
Point of Focus
Underwriting guidelines are updated by a
Underwriting guidelines are limited number of authorized individuals on a
not regularly updated by
timely basis to reflect changes in
authorized personnel to
underwriting strategy such as entry or
reflect changes in
departure from writing business based on
underwriting strategy.
geography, lines of business, class codes,
exposure limits, industry, etc.
Underwriting management performs regular
self-audits of the book of business to ensure
Underwriting decisions (new compliance with underwriting guidelines.
business placement, policy
The self-audits are risk based but also
endorsements, renewals,
provide for coverage for all underwriting
etc.) are not consistent with personnel and lines of business. Note: New
underwriting guidelines or system technology is available to automate
by unauthorized personnel.
underwriting decision-making ("expert
underwriting") particularly for high volume,
homogeneous lines of business.
Underwriters have requisite experience with
Underwriters have
lines of business to be underwritten and
insufficient experience to
afforded appropriate lines of authority.
assess complex or
Management also encourages the
specialist risks.
obtainment of professional qualifications (e.g.
CPCU, ARe, etc).
V
V
V
Page 2 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Control
Underwriting
Activities
Control
Underwriting
Activities
Control
Underwriting
Activities
Control
Underwriting
Activities
3/6/2016
Transaction
Process
Control Objective
Control
Objective
Control
Type
(CAVR)
Approval
Process
Management only accepts
contracts introduced
through an approved
distribution network.
Approval
Process
All policy submissions and
subsequent activities (policy
endorsements, renewals,
etc.) are considered for
approval on a timely basis.
Approval
Process
Acceptance of policy
submissions and
subsequent activities is only
granted upon receipt and C, A, V
assessment of all
underwriting and contract
information.
Approval
Process
Appropriate segregation of
duties between the
solicitation and acceptance
of policy submissions and
subsequent activities.
V
C
V, R
Control
Objective
Category
(C/FR/O)
Risk
FR
Contracts are accepted
from unauthorized
intermediaries (e.g.
unappointed, unlicensed
brokers and agents
including MGAs).
FR
Acceptance of duplicate
policy, incomplete
processing or backlog of
submissions and
subsequent activities.
FR
Acceptance of policy
submissions and
subsequent activities is
granted based upon
incomplete or inaccurate
underwriting and contract
information.
FR
Point of
Focus
Control
Type
(CAVR)
Point of Focus
A comprehensive list of approved brokers
and agents, including MGA relationships,
across all regions and lines of business is
maintained by a limited number of authorized
individuals. Submissions and subsequent
contract activities are only accepted from
intermediaries on the approved listing.
All policy submissions and subsequent
activities (via phone, email, hard mail, fax or
EDI) are logged. Policy submissions are
reviewed for enterprise-wide account
clearance and status (Open, Bound,
Declined) for each submission.
V
C
Underwriting documentation requirements
(e.g. applicant’s claim history, credit rating,
any outstanding judgments, full details of the
C, A, V
risk to be insured, geographical location,
etc.) are standardized as relevant to the
respective line of business
Appropriate segregation of duties exists
Production goals (e.g.
between the solicitation and acceptance of
premium growth) and/or
policy submissions and subsequent
compensation models lead
activities. Where direct segregation of such
to fraudulent or
responsibilities can't be implemented (e.g.
inappropriate acceptance of
marketing/territory representatives or "field
policy submissions and
underwriters"), there is an independent
subsequent activities.
review of the bound business.
V, R
Page 3 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Control
Underwriting
Activities
Transaction
Process
Control Objective
Pricing
Contract pricing accurately
reflects the risk assumed
and is consistent with the
Company’s business
objectives, reinsurance
program and capacity to
accept risk.
Control
Objective
Control
Type
(CAVR)
A
Control
Objective
Category
(C/FR/O)
FR
Monitoring Underwriting
Pricing
Management regularly
monitors contract pricing.
A
FR
Control
Underwriting
Activities
Pricing
Product pricing is adjusted
to reflect product
performance.
A
FR
Pricing
Product pricing complies
with regulatory
requirements.
V
FR
Control
Underwriting
Activities
3/6/2016
Risk
Point of
Focus
Control
Type
(CAVR)
Point of Focus
Contract pricing, including performed by third
parties (MGAs, agents, brokers, insureds,
Inappropriate pricing
etc.), is determined by standardized rate
(premium rates) is applied
tables and/or pricing models and use of
to contracts.
experience or schedule credit facilities are
appropriately used.
Underwriting management performs regular
self-audits of the book of business to ensure
use of correct rate tables, pricing models and
experience and schedule credit facilities
including review of pricing performed by third
parties (MGAs, agents, brokers, etc.). The
self-audits are risk based but also provide for
coverage for all underwriting personnel,
distribution channels and lines of business.
Pricing analysis is regularly performed of
claims experience and loss ratios by line of
business, intermediary and geographical
Product pricing is not
location and is incorporated into the
adjusted to reflect actual
Company's rate tables, pricing model and
experience by line of
guidance for experience and schedule credit
business.
facilities. Access to update rate tables
and/or pricing models is restricted to a limited
number of authorized personnel.
Unauthorized premium
Where required for particular jurisdictions or
rates may result in punitive
lines of business, regulatory approval is
sanctions from regulatory
obtained for pricing, including pricing
bodies.
changes.
Inaccurate or unauthorized
rate tables and pricing
models and/or inappropriate
use of experience and
schedule credit facilities are
used to determine contract
pricing.
A
A
A
V
Page 4 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Control
Underwriting
Activities
Control
Underwriting
Activities
Transaction
Process
Control Objective
Control
Objective
Control
Type
(CAVR)
Policy
Issuance
Policy documents issued for
all risks assumed.
C, A
FR
Policy
Issuance
Appropriate segregation of
duties between the
solicitation and processing
of policy submissions and
subsequent activities.
V, R
FR
Policy information recorded
on the Company's
Control
Transaction
Underwriting
administrative system is
Activities
Recording
restricted to authorized
personnel.
V, R
Authorized contract
information (including new
business placement, policy
Control
Transaction
Underwriting
endorsements, renewals, C, A, V
Activities
Recording
etc.) is recorded on the
Company's administrative
system on a timely basis.
3/6/2016
Control
Objective
Category
(C/FR/O)
FR
FR
Risk
Point of
Focus
Control
Type
(CAVR)
Point of Focus
The number/value of policies and
subsequent activities issued is reconciled to
the listing of approved transactions and the
Policyholders are not issued
confirmation of mailing. For automated
contracts on a timely basis.
policy issuance, the reconciliation may
include the use of batch headers and hash
totals.
Appropriate segregation of duties exists
Production goals (e.g.
between the solicitation and processing of
premium growth) and/or
policy submissions and subsequent
compensation models lead
activities. Where direct segregation of such
to fraudulent or
responsibilities can't be implemented (e.g.
inappropriate recording of
marketing/territory representatives or "field
policy submissions and
underwriters"), there is an independent
subsequent activities.
review of the bound business.
Policy details and terms are
Access to the Company's administrative
recorded in the Company's
system is restricted to authorized personnel
administrative systems by
through programmed authority levels.
unauthorized personnel.
Incomplete processing or
backlog of submissions and
subsequent activities in the
Company's administrative
systems.
C, A
V, R
V, R
All policy submissions and subsequent
activities (via phone, email, hard mail, fax or
EDI) are logged and reviewed for evidence of
underwriting approval prior to input into the
C, A, V
policy administration system. Logs are
regularly reviewed for confirmation of
processing and review of stale submissions
(i.e. quoted but not bound).
Page 5 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Transaction
Process
Control Objective
Transactions (including new
business placement, policy
Control
Transaction
Underwriting
endorsements, renewals,
Activities
Recording
etc.) are only recorded
against valid policies.
All transactions are
Control
Transaction completely and accurately
Underwriting
Activities
Recording recorded in the Company's
administrative system.
Control
Objective
Control
Type
(CAVR)
A, V
V
Control
Objective
Category
(C/FR/O)
Risk
FR
The underwriting
administration system
misrepresents in-force
polices.
FR
Inaccurate recording of
underwriting data due to
incorrect/invalid data entry
resulting in the
misclassification of policy
administration and financial
records.
Management monitors
completeness and accuracy
Control
Transaction
Underwriting
of data input into the
Activities
Recording
Company's administrative
system
C, A
FR
Management is unable to
identify significant data
entry problems in the
recording of underwriting
transactions.
The Company’s records
Control
Transaction
support al. transactions
Underwriting
Activities
Recording entered into the Company's
administrative system.
V
FR
Insufficient documentation
is retained to evidence
underwriting transactions
3/6/2016
Point of
Focus
Control
Type
(CAVR)
Point of Focus
System checks are in operation to prevent
duplicate policy inputs. Sequential policy
numbers are used with programmed controls
ensure that only transactions with a valid
policy number can be entered into the policy
administration system and spoiled policy
documents accounted for.
The Company's administrative system
performs edits and validations on the policy
input and a quality assurance program has
been implemented for independent review of
policy input. Rejected policy data is isolated,
analysed and corrected on a timely basis
through programmed controls, batch headers
and suspense accounts. Management
reviews resulting exception reports.
Management reviews policy information to
critically analyze premium activity, including
current and historical premiums trends, new
and renewal business, premiums by lines of
business, intermediary and insured.
The underwriting file clearly evidences
review by an appropriate official to confirm
that all required underwriting procedures
have been performed and documented and
appropriately entered into the Company's
administrative system.
A, V
V
C, A
V
Page 6 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Transaction
Process
Control Objective
Control
Objective
Control
Type
(CAVR)
Management monitors and
Transaction
C, A, V,
Monitoring Underwriting
tests the internal control
Recording
R
environment.
Control
Objective
Category
(C/FR/O)
FR
Control
Transaction
Underwriting
Activities
Recording
Premium transactions are
accurately reflected and
classified in the financial
ledgers
C, A, V
FR
Control
Transaction
Underwriting
Activities
Recording
Premiums are correctly
stated in the reporting
currency.
A
FR
Control
Transaction
Underwriting
Activities
Recording
Tax information derived
from premium activities is
accurately and promptly
reported.
C, A
FR
3/6/2016
Risk
Point of Focus
Point of
Focus
Control
Type
(CAVR)
Internal control weaknesses
Internal Audit reviews are conducted
over underwriting activities
periodically to determine whether data
C, A, V,
are not identified and
recorded in the policy administration system
R
resolved on a timely basis.
is accurate.
Inaccurate data input results
in the misclassification of
The financial sub ledgers are reconciled to
policy data and financial
the general ledger. Reconciliations are
C, A, V
records and the
reviewed and approved by financial
miscalculation of ADIAL due
management.
to inaccurate premium data.
Misstatement of premium
Translation of foreign currency written
and related income due to
premiums is calculated using prevailing
A
inaccurate or incomplete
exchange rates at the date of policy
foreign currency translation.
inception.
Documented procedures for developing,
summarizing, and reporting required tax
information. Review of major transactions or
Erroneous data may be
major classes of transactions by individuals
used in tax computations
who are knowledgeable about tax
C, A
and result in overpayments
requirements. Programmed sub ledger
or underpayments of taxes.
coding facilitates the automated
classification, summarization, and retrieval of
required tax information.
Page 7 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Transaction
Process
Control Objective
Control
Objective
Control
Type
(CAVR)
Relevant disclosure data is
Control
Transaction
gathered completely,
Underwriting
C, A, V
Activities
Recording accurately and on a timely
basis.
Adjustments
Control
Underwriting and Ledger
Activities
Maintenance
Adjustments
Control
Underwriting and Ledger
Activities
Maintenance
Prevention or detection of
incorrect entries to
policyholder accounts,
agents' balances and
reinsurance data.
Appropriate segregation of
duties between the entry
and approval of journal
entries (related to
underwriting transactions
not recorded in the
Company's administrative
systems).
Adjustments Polices and procedures
Control
Underwriting and Ledger exist for processing journal
Activities
Maintenance
entries.
3/6/2016
R
R
A, V
Control
Objective
Category
(C/FR/O)
FR
Risk
Point of
Focus
Control
Type
(CAVR)
Point of Focus
Recorded transactions capture and
aggregate required account disclosures
including:
- gross and net written premiums
Required GAAP/ MD&A/ 10- earned premium (including changes in
K disclosures are
unearned premium)
incomplete or inaccurate for
- allowance for bad debts
presentation in the financial
- insurance balances receivable
statements
- appropriate segmental and geographical
analysis
- associated cash flows
- material legal proceedings
FR
Unauthorized adjustments
are made to the financial
sub ledgers.
Access to ledger journal entries is restricted
to appropriate finance personal through
programmed authority levels.
R
FR
Unauthorized adjustments
are made to the financial
sub ledgers.
Appropriate segregation of duties exists
between the entry and approval of journal
entries
R
FR
Incorrect/ inconsistent
treatment of manual
adjustments between sub
ledgers.
A chart of accounts is maintained and
updated on a timely basis, establishing
procedures and account mappings for
processing journal entries to sub ledgers.
A, V
Page 8 of 9
Underwriting Cycle—P&C
COSO
Component
Cycle
Transaction
Process
Control Objective
Sub ledger journal entries
Adjustments
Control
represent valid adjustments
Underwriting and Ledger
Activities
to the Company’s financial
Maintenance
records.
Adjustments Sub ledger journal entries
Control
Underwriting and Ledger are recorded on a timely
Activities
Maintenance
basis.
Prevention or detection of
Adjustments
incorrect entries to
Control
Underwriting and Ledger
policyholder accounts,
Activities
Maintenance
agents' balances and
reinsurance data.
Sub ledgers are reconciled
Adjustments
Control
to policy administration,
Underwriting and Ledger
Activities
billing and reinsurance
Maintenance
systems.
3/6/2016
Control
Objective
Control
Type
(CAVR)
Control
Objective
Category
(C/FR/O)
Risk
Point of Focus
Point of
Focus
Control
Type
(CAVR)
V
FR
Incorrect of fraudulent
journal entries are recorded.
All journal vouchers are approved by
management and attached to supporting
documentation.
V
V
FR
C, A
FR
C, A
FR
Ledger maintenance
Manual adjustments are reviewed by an
activities are not recorded in appropriate official to ensure accuracy of cutthe correct financial period.
off.
The financial sub ledgers do The financial sub ledgers are reconciled to
not accurately reflect
the underlying policy administration, actuarial
current policy data,
and reinsurance systems. Reconciliations
reinsurance terms and
are reviewed and approved by financial
billings.
management.
Unreconciled suspense
Suspense accounts are reconciled and
accounts exist and are not reviewed by an appropriate official to identify
cleared on a timely basis.
and clear unusual or aged balances.
V
C, A
C, A
Page 9 of 9