Financial Audit Checklist

Retrieve last year's signed audit opinion, the management letter, and any unresolved Model Audit Rule (MAR) deficiencies. Carry-forward findings drive this year's risk assessment and scoping decisions.

NAIC Model Audit Rule requires lead and concurring partner rotation every five years and prohibits specific non-audit services. Document the auditor's independence representation and any pre-approved tax or actuarial work.

Establish overall materiality, performance materiality, and the clearly-trivial threshold. For carriers, loss reserves and reinsurance recoverables typically drive scoping regardless of size.

Tie the GAAP trial balance to the SAP Annual Statement blanks (Pages 2, 3, 4 and Schedule F). Document GAAP-to-SAP differences for nonadmitted assets, deferred acquisition costs, and reserve discounting.

Reconcile case reserves and IBNR to the appointed actuary's Statement of Actuarial Opinion. Roll-forward case reserves on a sample of open claims; recompute ALAE/ULAE allocations. Reserve drift between cadence updates is a common market-conduct finding.

Send confirmations to all reinsurers on Schedule F. Review treaty wording for any following-form mismatch — a treaty drafted to follow the cedant's fortunes may not align with the underlying form's coverage triggers, creating recovery gaps.

Test bound policies against the AMS effective dates and the unearned premium reserve calculation. Watch for surplus-lines policies booked but with stamping-office filings outstanding past the state window.

Confirm the annual Form B registration, any Form D related-party transaction filings, and the Form F enterprise risk report are filed with the lead state. Form A is required only on a change of control.

Sample bound policies and verify each producer's NPN, state resident/non-resident license, and CE status via NIPR for the bind state — not just where they hold a resident license. Lapsed CE = lapsed authority = potentially unauthorized transactions.

Many carriers screen at policy issuance but skip the claim-payment screen. Sample claim payments above a threshold and confirm the SDN check ran at payment date — claimants and assignees can be added to the list mid-policy.

Part 500 applies to any Covered Entity doing insurance business in New York. Confirm whether the entity meets the Covered Entity definition or qualifies for a limited exemption under §500.19.

Verify the CISO designation, biennial risk assessment, annual penetration test, MFA on remote access (including third-party VPN under §500.12(b)), and the §500.11 vendor risk program scope covers TPAs and document-handling vendors — not just IT vendors.

Sample bound policies against current binding authority documents — limit, line of business, hazard grade. Authority breaches are common at agencies with multiple appointed carriers and create rescission and E&O exposure.

For Texas business, verify the Chapter 542 timeline: 15 business days to acknowledge FNOL, 15 business days to decision after all info received, 60 days max. Each missed deadline triggers 18% statutory interest plus attorney's fees.

Pull current SOC 2 Type II reports for the policy admin system, claims platform, and any TPA. Map complementary user entity controls (CUECs) to internal controls; gaps in CUEC coverage are common audit findings.

Many states require putting the at-fault party on notice within roughly 6 months. Missing the window waives the carrier's recovery right and shows up as a market-conduct exam finding.

Categorize each finding as material weakness, significant deficiency, or control deficiency. Tie each to a specific control and a remediation owner with a target date.

Walk the audit committee through findings, management responses, and required communications under AU-C 260/265. Document independent discussions with the committee outside management's presence.