Insurance wiki

TPA audits: how delegated claims handling is audited

Reviewed by the Apex broking team · Last reviewed 2026-10-16

A TPA audit is a review by an insurer, managing agent or coverholder of how a third-party administrator handles claims on its behalf under delegated authority. It matters because the insurer stays responsible to policyholders and regulators for claims it has outsourced.

Part of: Claims handling

In short

When an insurer lets a third-party administrator (TPA) handle and settle claims, it delegates the work but not the responsibility. A TPA audit checks that the administrator is handling claims within its authority, reserving accurately, keeping proper file notes, treating customers fairly, handling complaints correctly and protecting personal data. In the Lloyd's market, managing agents audit coverholders and delegated claims administrators, often through coordinated audits using a standard market audit scope. The FCA's claims handling rules in ICOBS 8, its complaints rules in DISP and, for retail customers, the Consumer Duty all shape what auditors look for.

What a TPA audit is

A third-party administrator handles claims for an insurer under a written agreement, often called a claims service agreement or delegated claims authority. The agreement sets what the TPA can do: which claims it can handle, how much it can settle without referral, when it must escalate and what it must report. In the Lloyd's market, these firms are often called delegated claims administrators (DCAs), and the arrangement usually sits alongside a coverholder binding authority.

An audit is the insurer's way of checking that the TPA is doing what the agreement says. It usually combines a review of the TPA's systems, controls and management information with a sample of individual claim files. The FCA's outsourcing provisions in SYSC 8 rest on the principle that a firm which outsources important functions remains responsible for its regulatory obligations, and expects it to monitor the service provider's performance.

Why insurers and coverholders audit claims handlers

Regulatory responsibility: the insurer must meet the FCA's ICOBS 8 rules, which require it to handle claims promptly and fairly, give reasonable guidance and information on progress, not unreasonably reject a claim and settle promptly once terms are agreed. That duty does not pass to the TPA.
Financial control: the insurer relies on the TPA's case reserves and payments for its own accounts and reserving. Weak reserving distorts the insurer's view of the book.
Authority control: settlements above the agreed limit, or claims outside the class delegated, expose the insurer to leakage and disputes.
Customer outcomes: for retail customers, the Consumer Duty in PRIN 2A.6 requires firms to ensure customers do not face unreasonable barriers, and submitting a claim is one of the listed examples.
Market expectations: in the Lloyd's market, Lloyd's audit guidance describes managing agents auditing coverholders and DCAs on a risk-based basis to check, among other things, that claims are adjusted properly and in line with binding authority and service agreements.

What an audit typically reviews

Scope varies with the size of the account and the risks involved. A typical claims audit covers:

Area	What auditors commonly test
Authority limits	Settlements and reserves within delegated limits; referrals made where required
Reserving	Reserves set promptly, reviewed regularly and supported by file notes
File notes and documentation	Coverage decisions reasoned and recorded; key documents on file
Timeliness	Acknowledgement, contact and payment against agreed service levels
Fair treatment and Consumer Duty	Clear communication, no unnecessary information requests, vulnerable customers identified
Complaints	Complaints recognised, logged and handled under DISP 1.3, with root cause analysis
Data protection	Personal and special category data handled securely and only as needed
Fraud and sanctions	Checks carried out before payment, with escalation routes
Reporting and finance	Bordereaux accurate and on time; claims funds reconciled

File sampling is the heart of most audits. Auditors read a set of claims from notification to closure and score them against the agreement and the insurer's claims handling standards. An experienced claims auditor will look for patterns rather than single slips: repeated late reserves, missing coverage reasoning, or payments made just under a referral limit.

How the FCA rules apply

Several parts of the FCA Handbook shape a claims audit:

ICOBS 8 sets the core claims handling rule (ICOBS 8.1.1R) and guidance on when rejecting a consumer's claim is unreasonable, linked to the Insurance Act 2015 remedies.
DISP requires effective and transparent complaints procedures and management controls to identify and fix recurring or systemic problems. Auditors check that claims-related complaints reach the right process and that root causes feed back into claims handling.
The Consumer Duty applies to retail customers. Auditors commonly test whether claims processes create unreasonable barriers, delays or requests for unnecessary evidence.
SYSC 8 frames outsourcing: the insurer keeps responsibility and should be able to assess and monitor the provider's performance.

Data protection sits alongside. Under UK GDPR, the insurer and TPA need to be clear on their roles for personal data, and claims files often contain health data that needs extra care.

Audit outcomes

Audits usually end with a written report, a rating and a set of actions with deadlines. Common outcomes include:

Satisfactory: no or minor findings; audit frequency may stay the same or reduce.
Remediation actions: fixes to reserving practice, file notes or reporting, with follow-up checks.
Reduced authority: lower settlement limits or more referrals until performance improves.
Re-audit or closer oversight: an earlier follow-up audit or more frequent file reviews.
Termination: in serious cases, the delegated authority may be withdrawn and claims moved to another handler.

In the Lloyd's market, where several managing agents use the same coverholder or DCA, audits are often coordinated so the firm is audited once against a shared scope, rather than separately by each.

TPA audits vs related reviews

TPA audit vs coverholder audit: a coverholder audit focuses on underwriting authority, premium handling and policy documents; a claims audit focuses on claims. Where one firm does both, a single audit may cover both.
TPA vs loss adjuster: a loss adjuster investigates and values individual claims; a TPA runs a book of claims under delegated authority. See loss adjuster vs claims handler.
Audit vs complaint review: the Financial Ombudsman Service looks at individual eligible complaints; an audit tests the whole process.

What to check

If you are a TPA, coverholder or insurer preparing for an audit, check:

The authority limits and referral rules in the current agreement, and evidence they are followed.
Reserve review dates and file notes on a sample of open claims.
Complaints logs and root cause analysis.
Consumer Duty evidence for retail claims.
Data protection and security controls.
Actions from the last audit and whether they are closed.
Your own professional indemnity cover for claims handling errors.

Sources

Frequently asked

What is a TPA in insurance?

A third-party administrator (TPA) is a firm that handles claims, and sometimes other policy administration, on behalf of an insurer under a written agreement. The agreement sets the TPA's authority, including settlement limits and referral rules. In the Lloyd's market, claims TPAs are often called delegated claims administrators.

Why do insurers audit TPAs?

Because the insurer remains responsible to policyholders and the FCA for claims handled on its behalf. Audits check that the TPA works within its authority, reserves accurately, treats customers fairly, handles complaints properly and protects data. They also protect the insurer's finances by catching leakage and reserving errors early.

How often are claims handlers audited?

There is no single fixed frequency. Audit frequency is usually set by the agreement and the insurer's risk-based oversight, so larger or higher-risk accounts may be audited more often. Poor results commonly lead to earlier follow-up audits. In the Lloyd's market, audits are planned on an annual cycle and are often coordinated across managing agents.

Does ICOBS 8 apply to TPAs?

ICOBS 8 places claims handling duties on the insurer, including handling claims promptly and fairly and not unreasonably rejecting them. Where a TPA handles claims, the insurer remains responsible for meeting those duties, which is why its audits test the TPA's handling against them.

What happens if a TPA fails an audit?

Usually the TPA receives a list of actions with deadlines and a follow-up review. Depending on the findings, the insurer may reduce settlement authority, require more referrals or increase file reviews. In serious or repeated cases, the delegated authority may be terminated and the claims moved elsewhere.

Talk to a broker

Tell us about your business and a broker will come back to you with options. Or call 0117 325 0027.

Get a quote Start a commercial enquiry

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.