Combined Assurance Map That Overstates Coverage
A property and casualty insurer with $2.5 billion in gross written premium produced a combined assurance map covering 11 principal risks. For underwriting risk, the map marks full assurance because the first line completed 38 self-assessments, second-line compliance performed 4 file reviews, and external audit tested controls over premium recognition. Internal audit last audited underwriting four years ago; the CAE removed it from the plan after relying on the map. The map shows no gaps for claims handling even though the second line suspended claims reviews for nine months during a system migration. The audit committee wants to rely on the map to reduce internal audit coverage and reallocate two audit positions to an IT project. The CRO says the map is board-ready. No criteria for rating assurance levels are documented.
1. Critique the combined assurance map and its use for reliance decisions.
Read the worked answer
The map treats activity as assurance. First-line self-assessments are not independent and cannot by themselves support full assurance. Four compliance file reviews are a small sample and may not cover the underwriting risk profile. External audit tested premium recognition controls, a narrow financial reporting scope, not underwriting risk management. Internal audit has not examined underwriting in four years, so there is a coverage gap rather than full assurance. Claims handling is marked with no gaps despite a nine-month suspension of second-line reviews, which is an obvious assurance gap. The absence of rating criteria means full, partial, and gap labels are subjective. Relying on this map to reduce audit coverage would be unsafe. The CAE should not reallocate positions based on the map until the map is rebuilt with defined criteria, evidence of independence, scope, timing, and coverage depth.
2. Describe how internal audit should build a defensible combined assurance approach for underwriting and claims.
Read the worked answer
Internal audit should define assurance levels based on the independence and objectivity of the provider, the scope relative to the risk, the depth of testing, the timing, and the evidence available. It should map each principal risk to its key controls and then to the assurance providers, distinguishing first-line monitoring, second-line oversight, internal audit, and external audit. For underwriting, internal audit should assess whether compliance reviews covered the highest-risk portfolios and whether external audit’s scope is relevant. For claims, it should identify the migration period as a gap and plan coverage of changed controls and backlog. Internal audit should coordinate with external audit, review workpapers where reliance is proposed, and document the basis for any reliance. The map should show gaps and overlaps, not just coverage. Reliance should be approved at the CAE level and reported to the audit committee.
3. Advise the audit committee on the request to reallocate two positions based on the map.
Read the worked answer
The audit committee should not approve the reallocation on the current map. The map overstates assurance for underwriting and omits a known claims gap, so reducing coverage would increase risk. Internal audit should propose a phased approach: retain coverage for underwriting and claims in the current plan, validate the map through targeted testing, and only then consider reliance. If the IT project is mandatory, the committee should weigh the risk of reduced audit coverage explicitly and require compensating monitoring. The CAE should report the map’s limitations and the basis for any reliance. Reallocation can be revisited after internal audit has tested the second-line reviews and confirmed their scope and quality. The committee should also ask the CRO to document rating criteria and refresh the map for the suspended claims reviews before it is used for board reporting.