Internal controls over financial reporting in Australian insurance

Strong documentation turns an intention into evidence that others can test. For insurers, internal controls over financial reporting (ICFR) should link each material financial statement assertion to a defined risk, an accountable owner, a repeatable activity and retained proof of operation. The record must show how judgements were made, how errors were prevented or corrected, and why management is prepared to stand behind the numbers.

Australian insurers often operate across locations and systems. A policy administration platform in Sydney may feed premium and claims data into a group reporting model, while a Brisbane underwriting team makes catastrophe assumptions that later affect reserving. Finance, actuarial, underwriting, operations and IT need one traceable control record. When a Melbourne team says, with a fair dinkum, that the file has been checked, the evidence should still be obvious to someone outside the room.

At the IASA Conference, insurance accounting, finance, risk, tax, technology and customer administration are presented as connected disciplines. Standards define what must be reported, while controls determine whether the underlying data is complete, accurate and timely. Educational sessions supply fresh ideas, but every requirement or platform should be traced to a control objective, an owner and usable evidence. Exhibit-hall and peer conversations are most valuable when teams compare those details rather than shopping for tools in isolation.

This guide addresses finance leaders, operations teams, auditors, executives and emerging talent across Australia. It covers narratives, risk and control matrices, walkthroughs, automated controls, insurance estimates, evidence retention, regulatory context and remediation. The goal is a living documentation set that survives staff turnover and system change, supports the financial close, and gives the board and external auditor a defensible basis for reliance.

Set the reporting boundary and materiality

Start with the reporting perimeter. Identify every legal entity, branch, policy platform, actuarial model, reinsurance arrangement and outsourced service feeding the financial statements. Name the applicable framework, including AASB 17, and identify relevant APRA, ASIC and state obligations. Record which team owns each obligation and how differences are escalated.

Translate materiality into testable decisions. A small feed may need monitoring, while a manual judgement affecting insurance liabilities can be material despite low transaction volume. Scope controls around financial statement assertions, disclosure risks and management override, then link significant risks to activities. The scope statement should name exclusions, dependencies and evidence confirming that no material process was missed.

Use a controlled hierarchy: entity overview, process narratives, risk and control matrix, and flow diagrams showing systems and hand-offs. Give every document an owner, version, approval date, review date and change log. Retire superseded versions without deleting them; their history can explain how control changed after an exception, audit finding or implementation.

Connect risks, assertions and control objectives

A risk and control matrix becomes the backbone when each row tells a complete story. Record the risk event, financial statement impact, assertion, control objective, activity, owner, frequency, population, evidence, dependency, failure consequence and residual risk. “Review claims reserves” is too vague. A stronger entry states who performs the review, what triggers it, which data and assumptions are examined, how challenge is evidenced and what happens when a threshold is exceeded.

Use swimlane process maps to show who does what across underwriting, claims, actuarial, finance and technology. Mark automated feeds, spreadsheets, interfaces and manual judgements, including the exception path. The map should reveal segregation-of-duties gaps and manual rekeying that a process narrative can conceal. A control that works only when every transaction is routine is rarely dependable.

Build narratives and evidence trails

Evidence should be contemporaneous, attributable, complete and reproducible. A reconciled report stored in the finance system generally carries more weight than a spreadsheet emailed months later. A reviewer sign-off should identify the person, date, scope and exceptions considered. Retain evidence for the required audit trail, and make sure it shows the population reviewed rather than only a favourable sample.

Document what happens when a control fails. Require the preparer to record the condition, quantify its effect, identify the correction and link the remediation ticket to the exception. A “follow-up completed” label alone offers little assurance. For judgmental controls, retain the challenge, alternatives considered and decision made; a final number cannot prove that management override was addressed.

Document automated controls and dependencies

Document automated controls with the same rigour as manual ones. For each automated report, identify the system of record, calculation logic, configured parameters, population, exception criteria and output destination. Record who can alter the logic, who reviews the result and what proves that the job ran. Automation still depends on reliable inputs, access controls, interface processing and change governance.

IT general controls underpin application controls, so link them explicitly. Review access provisioning, segregation of duties, privileged administration, backup and recovery, interface reconciliation, change management and production support. A migration or new platform should trigger reassessment of dependent controls. Include data conversion and parallel-run checks in the close plan rather than assuming the previous control remains valid.

When assessing a potential technology vendor or solution such as Polygon ATL, ask how configurable logic, user access, audit logs, change history and evidence export support the documented control. Demonstrations should include exceptions and rejected transactions, rather than showing only a perfect process. Document who operates each control, what the customer must perform and how responsibility is shared when an outsourced service feeds the general ledger.

Address insurance-specific judgements

Insurance reporting contains judgements that cannot be reduced to a transaction match. Incurred but not reported claims, claims development triangles, reinsurance recoveries, future cash flows, liability for remaining coverage, risk adjustment and contractual service margin rely on assumptions and methods. Document the data lineage from policy and claims records through actuarial models to the ledger and notes. Retain model versions, approved assumptions, validation results and reconciliations to reported figures.

Design controls around judgement, not merely around activity. Require an independent actuarial challenge, an escalation threshold for movement and a reconciliation between actuarial outputs and booked amounts. Use scenario analysis for changes in claims inflation, discounting, catastrophe exposure and policyholder behaviour. Where management override occurs, retain the business rationale, supporting evidence and approval. A reviewer who merely agrees with the number has not performed a meaningful challenge.

Premium and reinsurance deserve equal attention. Controls should trace policy inception, endorsements, cancellations, commissions, premiums receivable, ceded premiums and recoveries across the billing cycle. Reconcile policy administration totals to insurance revenue and related ledger accounts, investigate differences by cause and age, and prevent duplicate or omitted transactions. The documentation should show how data-quality warnings, late payments and disputes are resolved before the financial close is approved.

Anchor controls in Australian practice

Australian insurers can sit within several reporting perimeters. AASB 17 aligns with IFRS 17 for relevant periods, while APRA’s prudential framework and actuarial standards can add valuation and reporting expectations for authorised insurers; ASIC and the Corporations Act remain central to corporate reporting. Where prudential valuation and financial reporting use different terminology, the control matrix should make the relationship explicit. APS 120, where relevant, influences actuarial valuation but does not replace a complete ICFR framework.

State and territory regimes add operational variation. CTP schemes, stamp duty, licensing and claims processes differ across markets such as NSW and Queensland, while GST and GST credits on claims-related costs need specific coding and reconciliation. For a group insurer, document how local teams identify jurisdiction, apply tax rules and escalate exceptions. Clear data definitions and local ownership prevent a rule change in one market from quietly altering group reporting.

Catastrophe exposure gives the documentation a distinctly Australian test. Bushfires, floods and storms can produce large claims volumes, rapid estimate revisions and pressure on reinsurance recoveries during the reporting window. Controls should identify the catastrophe assumptions used, claims data received, claims development impact and management review of catastrophe protection. Keep Australian dollars, foreign currencies and overseas reinsurance balances connected through recorded rates and reconciliation.

Test, remediate and sustain the control record

Test controls in layers. Perform walkthroughs to confirm that the documented activity matches what the control owner actually performs. Then test design effectiveness for every material risk and operating effectiveness through risk-based sampling. Record the population, sample selection, tester, date, criterion, result, exception and conclusion. Samples should reflect periods, product types, processing centres and exception populations rather than favouring clean transactions.

Classify deficiencies consistently, assess severity and likelihood, and escalate significant issues to the audit committee or risk governance group as required. A remediation plan should name an owner, due date, compensating control and evidence of closure. Track recurring issues after system changes, then feed root causes into training, process redesign and risk assessments. A smaller set of verified improvements is a better measure of control maturity than a long dashboard of overdue actions.

Keep the record current after each close, audit, regulatory review or major transformation, rather than refreshing it immediately before an inspection. Ask control owners and users to challenge stale narratives, confirm that evidence remains retrievable and record accepted limitations. Colleagues who have converted a practical lesson into a repeatable control can develop it into a professional session using the conference speaking guide, extending the discussion beyond their own organisation.

Register for the IASA Conference and bring a concrete control challenge: a manual reserve judgement, a broken reconciliation, a disputed access right or evidence that is difficult to retrieve. Use the educational sessions to compare insurance accounting, finance, technology, tax and risk practices, then test those ideas with peers and solution providers through networking and exhibit-hall conversations.

Make the next financial close an opportunity to demonstrate control ownership from source data to disclosure. Arrive with one evidence gap, leave with a clear owner and an agreed remediation path, and be ready to explain the resulting assurance confidently to the CFO, the board and the auditor.