The Backdated Inception: Internal Override and Broker Proximity
A claims quality reviewer at a commercial property insurer is checking a $900,000 fire claim from a restaurant. The policy was issued on 14 March; the fire occurred on 11 March; the declarations page shows an inception of 6 February. An underwriting assistant with seven years' service holds system rights to override inception dates, and the audit log shows four such overrides in the last 18 months, all on policies introduced by the same broker. Total premium across the four is $220,000 and potential claims exposure is $1.4 million. Two of the four risks have already had losses. HR advises that the employee's collective agreement requires union representation at any disciplinary meeting; the police economic crime unit will only take a case with a documented, defensible loss figure. The broker is a top-20 producer and has been told nothing.
1. Set out the investigation sequence for the next three weeks, including what you do before speaking to the employee or the broker.
Read the worked answer
Days 1–3: preserve, don't confront.
- Export immutable audit logs, access records, email and the underwriting assistant's workstation image.
- Do not change his system permissions yet. Removing access tips him off and creates an argument that evidence was prejudiced.
- Freeze the four policies and hold the claims, with neutral delay letters to the insureds that do not allege anything.
Days 3–7: reconstruct each file. For each of the four: date the submission arrived, bind timestamp, payment timestamp, loss date, and whether the proposal bears a genuine e-signature with an audit trail. Establish which files are internally consistent and which are not.
Days 7–14: the broker, framed as review. Ask the broker for the original submission emails and any correspondence referencing a loss before inception. A single email mentioning the fire before the bind date is decisive on knowledge.
Days 14–21: interviews. Interview the employee with union representation present, and the broker separately, only after the documentary record is fixed. Sequence matters: interview after you know the answer, never before.
In parallel: instruct forensic accounting on the loss figure, and legal on privilege and on the disciplinary process under the collective agreement.
2. How do you establish the loss figure, and how do you separate internal collusion from broker fraud and from genuine administrative error?
Read the worked answer
The loss is not the $1.4 million exposure. Build the figure from what actually happened or was intended:
- premium written on the four policies ($220,000 gross, net of commission, and net of what legitimate rating would have produced);
- claims paid or payable on backdated cover;
- investigation and defence costs.
For a criminal referral, intended loss is defensible only if documented: where cover was backdated to capture a loss that had already occurred, the intended loss is the claim amount net of premium. You must show the employee knew of the loss when the date was changed.
Separating the causes:
- User identity is not proof of who was at the keyboard. Check attendance and swipe records, VPN and device logs, and whether anyone else knew his credentials.
- Broker fraud leaves a trace in the submission: dates on emails, attachments created before the stated submission date, or a loss mentioned before inception.
- Genuine error has legitimate causes - a documented customer request, a conversion from a legacy system, a renewal with an agreed retroactive date. Look for a call recording or signed instruction.
The pattern is suggestive, not conclusive. Four overrides through one broker in 18 months is notable, but compare it to that broker's share of all overrides; a top-20 producer may simply generate volume. Absent a knowledge document, you may have a control failure rather than a crime.
3. Recommend the disposition: employment action, criminal referral, recovery and control remediation.
Read the worked answer
Employment. Suspend on full pay pending investigation, then follow the collective agreement: union representation at every disciplinary stage. Do not let the HR outcome substitute for the criminal decision, and do not let the criminal decision drive the HR outcome - they have different standards of proof.
Criminal. Refer once the loss figure is documented and defensible, with a chronology, the preserved logs and the reconstructed files. Expect the police to test whether your own controls allowed the conduct; answer that in the pack, not in the interview.
Recovery. Pursue in parallel and rank by value against cost: fidelity or crime bond, the broker's professional indemnity if the broker was complicit, civil claim against the employee, and recovery of premium on voided policies. Criminal compensation orders are slow and rarely full.
Controls - the part that outlasts the case.
- Remove standalone inception override rights; require dual authorisation for any effective date earlier than the bind date.
- Build an automated exception report: effective date before bind, by user, by broker, monthly to the chief underwriting officer.
- Add a broker-level analytics view of inception changes, with a challenge process.
- Test the audit log itself - can a user delete or alter entries? If so, fix that first.