Safety Norms: Insurance, Risk and Audit Advisory

1Purpose, Scope and Safety Principles

This document sets out practical safety norms for insurance, risk and audit advisory work. It is a starting point for locally approved procedures, not a substitute for them. Safety in this field covers three things: protecting people who visit client sites or handle sensitive materials, protecting clients, policyholders and the public from financial loss, fraud and misstatement, and protecting the independence and integrity of the advice itself. Most serious harm in advisory work is financial or reputational rather than physical, so these norms focus heavily on controls over money, information and judgment.

These norms apply to every person who plans, performs, reviews or supports insurance advisory, enterprise risk, internal audit, controls testing or assurance engagements, including employees, contractors and subcontracted specialists.

• Mandatory: no one may approve their own work, transactions or conclusions.
• Mandatory: information is used only for the purpose authorized in the engagement letter.
• Recommended: treat unexplained control overrides and missing evidence as potential fraud indicators until they are reviewed.

2Roles, Competence and Accountability

The engagement lead holds overall accountability for scope, staffing, independence confirmation, quality of conclusions and final sign-off. The engagement manager directs daily fieldwork and reviews working papers before they are shared. Each team member is accountable for the accuracy of their own evidence and for raising concerns they cannot resolve. The risk, compliance and quality function sets policy, reviews high-risk engagements and maintains the escalation route. Board or audit committee oversight applies where the engagement reports to governance bodies.

Competence means more than seniority. Before assignment, staff must be matched to the skills the work requires, such as knowledge of claims processing, reserving concepts, information technology controls or statistical sampling. Where a licence, professional qualification or regulatory registration is required for a task in the relevant jurisdiction, verify it with the issuing body or competent authority before work begins. Do not rely on a person's self-description of credentials.

• Mandatory: complete and file independence and conflict-of-interest declarations before receiving client data.
• Mandatory: work outside your authorized scope only after written approval from the engagement lead.
• Recommended: maintain a skills matrix and assign a supervisor to each junior team member.

3Course-Specific Hazards and Risk Assessment

The main activities in this field include planning and risk assessment, reviewing claims files and underwriting data, testing financial controls, examining general ledger and payment records, interviewing staff, observing processes on client premises, and issuing reports or advice that clients rely on. People involved include engagement teams, client finance and claims staff, third-party administrators, brokers, actuaries and, at times, regulators or law enforcement contacts. Tools include spreadsheets, audit analytics software, document management systems, claims and policy administration platforms, remote access tools and email.

Hazards fall into four groups. Financial hazards include misstatement, undetected fraud, improper payments and reliance on incomplete data. Information hazards include unauthorized disclosure of personal or commercially sensitive data and loss of devices. Conduct hazards include loss of independence, pressure from management and inappropriate gifts or hospitality. Physical hazards arise during site visits to plants, warehouses, loading bays, data centers and areas with elevated or confined access.

• High risk: concealed fraud, payments made to altered bank details, release of identifiable policyholder records, and conclusions reached without seeing supporting evidence. Rate as high and escalate immediately.
• Medium risk: incomplete sampling, scope creep, unverified management representations and shared passwords. Rate as medium and correct before reporting.
• Low risk: formatting errors and minor reference mistakes. Correct during review.
• Risk assessment: score likelihood and impact on a documented scale at engagement start, record the rating and owner, and reassess whenever scope, systems or personnel change.

4Preventive Controls and Safe Work Practices

Preventive controls work best when they remove the opportunity for error or abuse before it occurs. Segregation of duties is the central control. The person who requests a payment, changes vendor bank details, records a claim reserve, posts a manual journal or approves a settlement must not be the same person who authorizes or reconciles it. Where the client cannot separate duties, the engagement lead must document a compensating control, such as independent review of a sample of transactions, and report the weakness to the client in writing.

Safe working practice also covers how evidence is gathered. Use read-only access wherever practical. Do not test controls on live payment or claims systems without written approval from the client system owner and an agreed test plan, and never create test transactions that could reach a real payee. Verify any change to bank details or payee identity through a known, independently sourced contact, never through contact details supplied in the request.

Professional skepticism is a control in itself. Corroborate management explanations with source documents, third-party confirmations or system data. Record why a sample was selected and why each exception was accepted or rejected.

• Mandatory: no payment, reserve change or journal may be authorized by the person who prepared it.
• Mandatory: vendor bank detail and payee changes require callback verification using a previously recorded telephone number.
• Mandatory: obtain written authority before accessing any restricted area, system or server room.
• Mandatory: on client premises, follow the host site's induction and sign-in process and wear any required personal protective equipment, such as high-visibility clothing or safety footwear.
• Recommended: use independently extracted data, reconciled to source control totals before analysis.
• Recommended: vary sample selections and avoid announcing tests in advance where the engagement plan allows.
• Recommended: keep a written log of all data requests, extracts and transfers.

5Equipment, Environment, Information and Protective Safeguards

Information safeguards apply to every file. Use only approved devices and accounts. Apply multi-factor authentication to remote and cloud access, encrypt laptops and removable media, and prohibit personal email, consumer file-sharing sites and unapproved messaging apps for client data. Store hard copy in locked cabinets and follow a clean-desk rule when leaving a workstation. Lock screens whenever you step away.

Privacy duties depend on jurisdiction. Where personal data such as policyholder health information, claimant identities or bank details is involved, collect only what the work requires, mask or redact it in working papers, and apply the retention and destruction schedule in the engagement letter. Confirm the lawful basis for processing and any cross-border transfer restrictions with the privacy or legal function. Privacy and data protection rules vary by jurisdiction and should be verified with a qualified adviser.

Physical and environmental safeguards matter during site visits and travel. Wear the equipment the site requires, avoid walking through active loading areas without an escort, and never climb onto racking, roofs or equipment. Lone working away from the office needs a check-in schedule agreed with the engagement manager. Set up workstations to reduce strain, take regular breaks from screens and report discomfort early.

• Mandatory: report lost or stolen devices immediately under the incident procedure.
• Mandatory: carry only the client data needed for the visit and keep unneeded files in secure storage.
• Recommended: use privacy screens in open offices and at client sites.
• Recommended: keep an emergency contact list and travel plan for every off-site visit.

6Incident Reporting, Emergency Response and Escalation

Report promptly any suspected fraud, misappropriation, bribery or pressure to change findings, any suspected data breach or misdirected email, any control failure that could cause a material misstatement, any near miss that could have led to loss, and any injury, illness or hazard on site. Report to the engagement lead and the risk or compliance function at once. Do not wait to confirm facts before reporting. Early reporting is expected and protected.

Do not confront suspected individuals, alert them or attempt to investigate suspected fraud alone. Preserve evidence by securing original documents, system logs and devices, and record what was observed, when it was observed and who was present. Where the matter may involve a crime or a public-interest concern, the compliance function decides whether to involve legal counsel, the client audit committee or the relevant authority. Breach notification and regulatory reporting deadlines are set by law and vary by jurisdiction, so confirm them immediately.

For injuries or medical emergencies, call local emergency services first, then apply first aid only if trained to do so. Follow the host site's evacuation and emergency instructions. Anyone who reports in good faith must be protected from retaliation, and anyone who receives such a report must keep the reporter's identity confidential as far as the law and the investigation allow.

• Mandatory: escalate suspected fraud to the engagement lead and compliance on the same working day it is identified.
• Mandatory: do not delete, edit or move files relevant to a suspected incident.
• Recommended: keep an escalation log showing the time, the person notified and the action taken.
• Recommended: hold a short lessons learned review after every closed incident.

7Records, Training, Inspection and Review

Accurate records are a safety control. Working papers must show the objective, procedure performed, evidence obtained, conclusion reached and reviewer sign-off. Record every change to a finding and the reason for it. Use version control, restrict edit rights to the file owner and avoid unrecorded verbal approvals. Records should be complete enough that an independent reviewer could reach the same conclusion from the file alone.

Training must be role-specific and recorded. New staff complete induction covering these norms, information security, anti-fraud awareness, conflict-of-interest rules and host site safety. Refresh training when systems, laws or methods change, and verify with the relevant professional body whether any continuing education is required under local rules.

Monitoring and review close the loop. Quality reviewers should inspect a sample of completed engagements, check access logs for restricted data, reconcile exception reports and feed lessons into the methodology. Management should review measures such as overdue escalations, repeated control exceptions and training completion, and adjust these norms accordingly.

• Mandatory: retain engagement records according to the retention schedule and any legal hold instructions.
• Recommended: perform periodic file inspections using a documented checklist.

8Conclusion and Practical Checklist

These norms protect people, clients and the integrity of assurance work only when they are applied consistently. Treat them as minimum standards. Where local law, professional standards or an employer policy sets a stricter requirement, follow the stricter rule. Confirm current laws, standards and regulator guidance with competent authorities or qualified professionals, because they change and differ by location. This guidance is educational and does not replace formal training, professional authorization or supervision.

Implementation checklist

• Confirm independence and conflict declarations before receiving any client data.
• Verify scope, roles and authorizations in writing at engagement start.
• Check that no person approves their own payment, reserve, journal or conclusion.
• Callback verify every change to bank details or payee information using a previously recorded number.
• Use approved devices, encryption and multi-factor access for all client information.
• Redact or minimize personal data in working papers and carry only what the visit requires.
• Escalate suspected fraud or data breach to the engagement lead and compliance on the same working day.
• Preserve evidence and do not confront or alert suspected individuals.
• Complete working paper review and sign-off before any report is issued.
• Record training, incidents and lessons learned for periodic review.