Safety Norms: General and Property Insurance Operations

1Purpose, scope, and safety principles

These norms apply to staff, contractors, and agents who take part in underwriting, policy issuance, endorsements, renewals, premium billing, claims intake, loss adjustment, claim payments, salvage and subrogation recovery, and property inspection. They cover physical safety at sites and offices, and the financial and information safety that protects the business and its policyholders.

Three principles guide every norm. First, no single person should be able to create, approve, pay, and reconcile the same transaction. Second, every decision that moves money, changes coverage, or exposes personal data must leave a traceable record. Third, doubt triggers escalation, not silent resolution. Mandatory rules are marked MUST, and recommendations are marked SHOULD. Legal and regulatory requirements are jurisdiction-dependent and must be verified with competent authorities or qualified professionals.

2Roles, competence, and accountability

The chief financial or operations executive owns the control framework and approves the delegation of financial authority in writing. Line managers for claims, underwriting, and finance are accountable for their teams staying within limits. The compliance function interprets regulatory obligations, reviews fraud typologies, and owns the suspicious activity escalation route. The information security lead owns access control and data protection standards. Each employee is accountable for following these norms and for reporting concerns.

• MUST: Every user holds a documented authority limit for payments, reserve changes, claim settlements, and premium adjustments, and may not exceed it.
• MUST: Staff complete role-specific training before receiving payment, claim authority, or system administration rights.
• MUST: Adjusters, underwriters, and claims handlers hold the licenses or appointments their jurisdiction requires. Verify current requirements with the licensing authority.
• SHOULD: Managers review authority matrices regularly and after any organizational change.
• MUST NOT: Staff may not approve their own claims, policies, endorsements, or payments, or those of immediate family members or close associates.

3Course-specific hazards and risk levels

Realistic activities include risk selection and pricing, quoting, binding coverage, issuing documents, collecting premiums, notifying losses, inspecting damaged property, estimating repairs, negotiating settlements, issuing payments, and transferring risk to reinsurers. The people involved include underwriters, brokers and agents, claims adjusters, field inspectors, repair contractors, finance clerks, and customers. Tools include policy administration systems, claims platforms, document management, payment systems, spreadsheets, mobile inspection devices, and cameras or drones where permitted.

Each hazard should be rated for likelihood and impact using the company risk matrix, with High, Medium, and Low ratings. A High rating requires a documented control owner and review before the activity continues.

• High: Unauthorized or duplicated claim payments, altered bank details on payees, and invoice or endorsement fraud. Control: dual authorization and independent verification of payee bank details.
• High: Staged or inflated losses, and collusion between internal staff and repair vendors. Control: vendor onboarding checks, rotation of assignments, and anomaly review.
• High: Exposure of policyholder health, financial, or identity data through misdirected email or unsecured devices. Control: encryption, least-privilege access, and approved transfer channels.
• Medium: Physical injury during site inspections, such as falls, unstable roofs, structural collapse, electrical hazards, or animal bites. Control: site safety assessment, lone-working rules, and withdrawal criteria.
• Medium: Errors in reserves, premium calculations, or coverage wording that cause financial misstatement. Control: peer review and reconciliation.
• Low: Ergonomic strain from desk work and long drives. Control: standard workstation setup and scheduled breaks.

4Preventive controls and segregation of duties

Segregation of duties is the core preventive control. The person who sets up a payee must not release the payment. The person who approves a claim settlement must not reconcile the payment ledger. Underwriters who bind risks must not also issue refunds. Where staffing is too small to separate duties, the business must add a compensating control, such as independent review by a manager outside the process, and record the exception with a defined end point.

Field inspections require a pre-visit plan. Staff must not enter structures that appear structurally compromised, must not work alone at high-risk sites without a check-in arrangement, and must withdraw and report when conditions change. Inspectors must follow the site owner's safety rules and must not carry cash or accept payment at sites.

• MUST: Require two-person authorization for payments above the approved threshold, for any change to payee bank details, and for reserve reductions.
• MUST: Verify new or changed bank details through a callback to a number held on file, never a number supplied in the request itself.
• MUST: Reconcile claim payments and premium receipts to source documents on a fixed schedule, with differences investigated by someone other than the preparer.
• MUST: Require independent inspection evidence, photographs, and estimate review before settling property losses above the threshold.
• SHOULD: Rotate claim files and vendor assignments where one adjuster or vendor handles a high volume of similar losses.
• MUST NOT: Use shared logins or allow staff to approve their own work.

5Financial control and fraud prevention

Fraud in insurance operations often looks like ordinary paperwork: a duplicated invoice, a slightly altered estimate, a new vendor with a personal bank account, or a claim that arrives just after coverage was added. Staff should treat unusual timing, pressure to bypass steps, urgent payment requests, and reluctance to share documents as warning signs. Red flags are not proof of wrongdoing, but they require documented review.

Suspicious activity must be escalated to the compliance or special investigations unit without tipping off the subject. Do not confront the person, do not alter the file to hide the concern, and do not investigate independently. Anti-money laundering and fraud reporting duties are jurisdiction-dependent; verify current obligations with the relevant authority and legal counsel.

• MUST: Screen new policyholders, claimants, brokers, and vendors against the sanctions and watch lists the company is required to use, following the approved screening procedure.
• MUST: Check repair estimates against an independent pricing reference and document any variance above the company threshold.
• MUST: Flag claims reported shortly after a policy inception, increase, or lapse for enhanced review.
• MUST NOT: Accept or request cash, gift cards, or payments to personal accounts, or make payments outside approved systems.
• SHOULD: Keep a fraud indicator log that compliance reviews at a set interval.

6Data confidentiality, privacy, and information security

Claims and underwriting files contain health details, financial records, identity documents, and property addresses that criminals may exploit. Access must follow the need-to-know principle. Personal data handling is governed by privacy and data protection laws that differ by jurisdiction, so confirm obligations with the privacy officer and qualified counsel.

Photographs taken during inspections may capture personal information or third parties. Staff should avoid recording people where possible, and store images only in the approved claim system.

• MUST: Use only approved systems and encrypted channels to transmit policyholder data. Do not send claim files to personal email or consumer messaging apps.
• MUST: Lock screens when away from the desk and dispose of printed sensitive documents through secure shredding.
• MUST: Report lost devices, suspected phishing, or unexpected requests to change payment details the same working day.
• SHOULD: Review user access rights when roles change and remove access when employment or contracts end.
• MUST NOT: Access files without a business reason, including files involving relatives, neighbors, or colleagues.

7Incident, near-miss, emergency, and escalation procedures

Report physical incidents, data breaches, suspected fraud, payment errors, and near misses promptly through the approved reporting system. In an emergency involving injury, fire, or an immediate threat, call local emergency services first, then notify the site lead. Staff must not attempt rescues or enter unsafe structures. Serious incidents must be escalated to management and, where obligations apply, to regulators or insurers within timeframes set by law and policy.

Field staff must carry a current emergency contact sheet on every site visit, and must stop work immediately if a hazard cannot be controlled.

• MUST: Notify the manager and the relevant control owner of any misdirected payment or suspected fraud on the same working day it is identified.
• MUST: Preserve evidence, including emails, system logs, and original documents, without altering them.
• MUST: Place a hold on a payment or payee change pending review when fraud is suspected, following the approved hold procedure.
• SHOULD: Hold a short lessons-learned review after significant incidents, within a period set in local procedure.
• MUST NOT: Discuss suspected fraud with the subject, other claimants, or external parties except as directed by compliance.

8Records, training, monitoring, and review

Accurate records are a safety control. Each decision on coverage, reserves, payments, and recoveries needs a note stating the basis, the evidence, and the approver. Corrections must be made by adding an audit trail entry, never by overwriting history. Training records, authority matrices, and risk assessments must be retained for the period required by applicable rules. Retention periods are jurisdiction-dependent.

These norms are a starting point. Local procedures must be reviewed by qualified professionals, aligned with current laws and regulator guidance, and approved by accountable management before use. This document does not replace formal training, supervision, legal advice, or emergency services.

• MUST: Record the rationale for every reserve change and claim settlement above the threshold.
• MUST: Complete refresher training on fraud awareness, privacy, and the authority matrix, plus role-specific training before system access is granted.
• SHOULD: Sample a defined share of files in each review cycle for quality, following the approved sampling plan.
• SHOULD: Track indicators such as payment exceptions, overdue reviews, and access removals, and report them to the control committee.
• MUST: Update these norms and local procedures after material incidents, regulatory change, or system changes.

Implementation checklist

• Confirm your payment and claim authority limits in writing before acting.
• Verify any change to bank details by callback to a number held on file.
• Confirm a second person has reviewed payments above the threshold.
• Check that each reserve or settlement change has evidence, a rationale, and an approver recorded.
• Screen new parties and flag early-policy or post-change losses for enhanced review.
• Escalate suspicious activity to compliance the same working day without tipping off the subject.
• Send policyholder data only through approved, encrypted channels.
• Lock your screen, secure printed records, and confirm site safety before any inspection.
• Report incidents and near misses through the approved system the same working day.
• Confirm current laws, regulator guidance, and training status with qualified professionals.