Control Overload in Motor Claims

The design confuses control quantity with control assurance. A control at each of 34 steps is likely to be over-control: it adds cost and cycle time, creates false assurance, and obscures the controls that actually mitigate the regulatory risk. Regulators require effective controls, not maximal controls.

Apply risk-based principles:

• Start from the regulatory obligation: four-eyes above €50,000, documented checks, retained audit trail. Translate each into a control objective, then design the minimum set of key controls that achieves it.
• Distinguish preventive from detective controls. Four-eyes approval is preventive; reconciliation and exception analytics are detective. Not every step needs both.
• Distinguish key controls from monitoring. Only controls that materially mitigate a risk should be tested as key controls; the rest can be monitored.
• Segregation of duties: the finding that three adjusters can approve and pay is a serious design flaw. No amount of step-level control fixes that; the role model must change.
• Automation: automated validation, limits, and duplicate checks can enforce controls without human touches, preserving straight-through processing.

Three lines of defense: claims management owns the controls (first line); compliance and risk set the control framework and monitor (second line); internal audit provides independent assurance (third line). The current design puts compliance in the position of endorsing 34 controls without a risk rationale, which weakens the second line. The board should ask for a control matrix that maps each obligation to a key control, an owner, a frequency, and evidence. That is assurance; 34 controls is activity.

Segment by risk, not by step count. Most claims are low value and low risk; a small tail carries the regulatory risk.

Target control set:

1. Automated threshold rule: claims above €50,000 route to a four-eyes queue; below threshold, straight-through if all data validations pass. This preserves STP for the low-risk population and concentrates human effort where the regulation requires it.
2. Segregation of duties: system-enforced separation between approval and payment release. Remove the ability of any adjuster to do both. This is a preventive, system-level control and directly addresses the audit finding.
3. Documented checks: a mandatory evidence checklist at the decision point, with structured data capture rather than free text. Evidence attaches to the claim record automatically.
4. Exception-based review: daily analytics for duplicate claims, unusual payment patterns, threshold splitting, and override frequency. This is a detective control that covers the population, not a sample.
5. Override governance: overrides require a reason code, approver, and time limit; the log is system-generated and immutable. The current manual log should be retired.
6. Audit trail: system-level event logging with seven-year retention, including who viewed, changed, approved, and paid. Test restoration, not just the retention policy.
7. Model and rule governance: changes to thresholds and routing rules require approval and are versioned.

Expected effect: human four-eyes applies to the high-value tail, not all claims; STP stays high for low-risk claims; the key controls are testable. Estimate the volume above €50,000 and the capacity needed before committing to the service-level impact.

Assurance is evidence that controls operate as designed, not a statement that controls exist. Build a control assurance pack with four layers.

1. Traceability: a control matrix from regulatory obligation to control objective to key control to process step or model element to evidence to owner. The BPMN model should reference the control IDs, not duplicate them.
2. Design effectiveness: evidence that the control, as designed, would mitigate the risk. For four-eyes, show the role configuration, the routing rule, and a test that separation cannot be bypassed. For the audit trail, show the log schema, the retention job, and a restore test.
3. Operating effectiveness: sample testing and continuous monitoring. Report sample size, exceptions, root causes, and remediation. Add population-level analytics such as override rate, split-claim indicators, and approval cycle time so the board sees the whole population, not a sample.
4. Independent assurance: internal audit tests key controls and reports to the audit committee. Compliance monitors the second line. Management attests quarterly.

Board reporting: a one-page dashboard with control coverage, exceptions, overdue remediation, and service-level impact. State explicitly which risks are accepted and by whom. Avoid reporting the number of controls as a success metric; report the number of key controls tested, the exception rate, and the trend.

Finally, define what would cause a control to fail and how quickly it would be detected. That is the question the regulator and the board are really asking.