Insurance, Risk and Audit Advisory

01Purpose and scope

• This manual supports the course Insurance, Risk and Audit Advisory. It describes how advisors who review insurance programs, enterprise risk registers and audit readiness actually carry out that work day to day, including the documents they request, the conversations they hold and the points where professional judgment matters most.
• The scope covers three connected activities. First, the advisor examines whether the insurance program fits the organization's exposures, including limits, sublimits, deductibles, exclusions and the contracts that move risk to vendors or customers. Second, the advisor tests whether the risk management process identifies, rates and tracks exposures in a form leadership can act on. Third, the advisor helps the organization prepare for, or respond to, an internal or external audit by checking that controls exist, operate and leave evidence behind.
• This manual does not replace qualified professional judgment, licensing, approved procedures or required authorization. Coverage interpretation, placement decisions, financial reporting opinions and regulatory filings depend on the rules of the jurisdiction and on the role the advisor holds, so confirm the current authoritative source before acting on anything described here.

02Core principles

• Advice follows the exposure, not the policy. A certificate of insurance or a risk register is only a description of protection. The advisor's first question is what could realistically go wrong, what that loss would look like in dollars and operations, and whether the current coverage or control would respond at all.
• Independence comes before convenience. If the advisor helped design a control and later reviews it, that conflict must be separated or disclosed. Professional internal audit guidance, including the Global Internal Audit Standards issued by the Institute of Internal Auditors, addresses objectivity directly, and the same concern applies to any advisor whose fees depend on the outcome.
• Evidence beats assertion. A manager who says backups are tested every week has made a claim. A test log showing the date of each restore, the systems restored and the time to recover is evidence. The advisor records which one was relied on and why.
• Proportion matters. A ten-person bakery and a regional hospital network should not receive the same risk framework. The depth of work should match the size, complexity and consequence of the exposures, and a lighter approach is often the right answer when the stakes are modest.

03Planning and preparation

• Start by stating the engagement question and the decision it supports. A board asking whether cyber coverage limits match the estimated cost of a ransomware event needs a different analysis than a finance team asking whether a new contract requires additional liability insurance. Name the recipient of the output before any fieldwork begins.
• Collect the core documents early. For insurance work, that means policy schedules, endorsements, the last several periods of loss runs, broker placement summaries and any certificates issued to counterparties. For risk and audit work, add the current risk register, prior audit reports and open issue logs, relevant contracts with indemnity or insurance clauses, and an organization chart showing who owns each risk and control.
• Agree in writing on access, timing and out-of-scope items. Confirm whether the work is advisory, assurance or a blend, because the expectations, reporting language and independence considerations differ. A short engagement letter prevents the common situation where a verbal request grows into a review of everything the organization owns.
• Build a request log with an owner, a due point and a status for each item. Many delays come from a single missing loss run or a control owner who has left the company, so the log should show those gaps as soon as they appear.

04Recommended workflow

1. 1
   : Confirm the scope, the decision and the audience. Restate the question in a sentence and check it with the sponsor. If the sponsor cannot say what they will do with the answer, the scope is probably still too vague.
2. 2
   : Map exposures to the program. List the material risks, such as property damage, business interruption, product liability, cyber events, employment claims, directors and officers exposure and vendor failure. For each, identify the policy or contractual transfer that is supposed to respond and the internal control that is supposed to reduce the likelihood.
3. 3
   : Test coverage against the exposure. Compare limits, sublimits, deductibles, waiting periods, exclusions, notice conditions and definitions of covered events to the modeled loss. Read the exclusions with the same care as the insuring agreement, since most disputes arise there. Where the broker's summary and the policy wording differ, rely on the wording and document the gap.
4. 4
   : Walk through controls with owners. Ask the control owner to describe the process as it runs, not as it is written in the procedure. Select a sample of transactions, incidents or approvals, then inspect the underlying records to see whether the control operated as described and within the period under review.
5. 5
   : Rate findings using the organization's own scale. Most organizations use a likelihood and impact matrix, and some use a formal enterprise risk management framework such as the one described in ISO 31000. Apply the scale consistently, and note any finding where the rating depends on an assumption that management has not yet confirmed.
6. 6
   : Draft recommendations that a manager can act on. Each recommendation should name the owner, describe the change in specific terms, estimate the cost or effort at a useful level of precision, and propose a realistic completion point. Recommendations such as improve governance are too vague to track and usually stall.
7. 7
   : Validate facts before release. Send each finding to the control owner or risk owner for factual accuracy review. Record management's response, including any disagreement, and keep the original evidence reference so that the disagreement can be resolved on the record rather than in a meeting.
8. 8
   : Issue the report and track closure. Deliver the report to the agreed recipients, then add each recommendation to an issue log with a closure test. Closure should require evidence that the change operates, not only a statement that it has been completed.

05Quality checks, risk controls and compliance

• Every workpaper should be reviewed by someone other than the preparer before the report is issued. The reviewer checks that the conclusions follow from the evidence, that samples were selected in a defensible way, and that the wording of each finding matches what the evidence supports. A review checklist kept in the file makes this step visible to later reviewers.
• Reconcile figures across sources. Loss runs from the broker, the claims ledger and the finance accrual for claims payable often differ in timing and definitions. Document the reconciling items rather than choosing whichever number looks cleanest. Where the advisor cannot reconcile a material difference, report the difference as a limitation.
• Confirm coverage positions in writing. Verbal comments from a broker or carrier representative are not a basis for a coverage conclusion. Request written confirmation, and where a coverage dispute is possible, involve qualified legal or coverage counsel before stating a view to the client.
• Handle personal and claims data with care. Claims files often contain medical information, employee details or customer records. Limit access to what the engagement needs, store copies in approved locations, and follow the organization's retention and deletion rules. Data protection requirements vary by jurisdiction and by sector, so check the current requirements with the privacy function.
• Declare conflicts of interest. If the advisor has a relationship with a broker, carrier, software vendor or auditor involved in the work, disclose it in the engagement file and to the sponsor. Some regulated professions, including licensed insurance producers and certified public accountants, have their own rules on referrals, commissions and independence, which should be checked against the relevant licensing authority.

06Collaboration and documentation

• Most of the work depends on a small set of relationships. The engagement lead manages the sponsor and the schedule. The risk manager or insurance manager usually knows the program best. Control owners hold the evidence, the broker or carrier representative explains placement and wording, and legal counsel advises on contractual and privilege questions. Agree on who speaks for each area before interviews begin.
• Use one evidence index for the whole engagement. Each entry should list the document, the source, the date it was received, the person who provided it and the workpaper where it is used. When a finding later changes, the index shows which evidence is affected. Keep the index current during fieldwork rather than rebuilding it at the end.
• Keep management responses in the record. Responses should be quoted or attached, not summarized by the advisor. If management accepts a finding but proposes a different remedy, record both positions and the reason the advisor accepts or rejects the alternative.
• Consider privilege before writing. Communications about potential litigation or coverage disputes may be protected when counsel directs the work, but the protection depends on the jurisdiction and on how the engagement was structured. Involve counsel early when those topics arise, and label materials according to the instructions counsel gives.

07Measures and continuous improvement

• Useful indicators tie back to the decisions the work supports. Examples include the share of material exposures that have a named owner, the share of key controls with evidence on file for the period, the number of repeat findings in a year, the time from finding to verified closure, the count of coverage gaps identified against the modeled loss, and claim frequency and severity trends by business line. Track a small set consistently rather than a long list that nobody reviews.
• Be alert to how metrics can distort behavior. If the organization is measured only on the number of closed findings, managers may close items with weak fixes. Pair each metric with a periodic sample that tests whether the closure was real. Where numbers are used to compare business units, explain the differences in exposure before drawing conclusions.
• Review the advisory process itself after each engagement. Ask what evidence took longest to obtain, which questions produced the most useful answers, and where the initial scope proved wrong. Record these lessons in a short retrospective and update the planning template so the next engagement starts from a better base.
• Recognize the limits of the framework. A tidy risk register does not show that the organization can survive a severe event, and a clean audit opinion does not show that every significant exposure is insured. Say so plainly in reports, so that leadership does not take a compliance result as a general assurance of resilience.

08Common mistakes and how to prevent them

• Relying on broker summaries without reading the policy wording is the most frequent error in insurance review. Summaries are written to be brief and often omit the exclusions that matter in a claim. Obtain the full forms and endorsements, and read the definitions that govern the event under review.
• Treating the risk register as a finished product is another common problem. Registers often reflect the view of one workshop held long ago. Ask when each risk was last rated, who changed the rating and what new information triggered the change.
• Sampling too narrowly leads to false comfort. Testing five approvals from the most organized month of the year does not show the control operated throughout the period. Vary the sample across time, locations and staff, and state the sampling method in the report.
• Mixing advisory and audit roles without disclosure creates independence problems. If the advisor designed the control, another reviewer should test it, or the report should state the conflict and the safeguards used.
• Writing recommendations that cannot be tracked wastes everyone's time. Replace phrases such as strengthen oversight with a specific action, an owner and a closure test. Confirm the owner can realistically deliver it before the report is issued.
• Skipping the factual accuracy review invites disputes after release. A short review cycle with control owners catches wrong dates, misnamed systems and misunderstood processes, and it builds the credibility the advisor needs for the next engagement.

09Practical checklist

• Restate the engagement question and confirm the decision it supports with the sponsor.
• Obtain full policy wordings, endorsements, loss runs and the current risk register before fieldwork.
• Map each material exposure to its insurance transfer, contractual transfer and internal control.
• Compare limits, deductibles, exclusions and notice conditions to the modeled loss for each exposure.
• Select samples across the full period and document the selection method and population.
• Reconcile loss data across broker, claims and finance sources, and record any unresolved differences.
• Obtain coverage positions in writing and involve counsel where a dispute is possible.
• Disclose conflicts of interest and confirm independence before issuing conclusions.
• Send findings to owners for factual accuracy review and record management's responses in full.
• Add each recommendation to the issue log with an owner, a closure test and a target point for review.

★Learning sources

• Micro Degree: Insurance, Risk and Audit Advisory
• Micro Degree: Leadership and Team Management
• Micro Degree: Business Intelligence Management
• Micro Degree: ESG Advisory Services