Delegated authority risk assessment template: a file that holds up

A delegated authority risk assessment template is the standard file an insurer keeps on each MGA or coverholder: how much risk the delegate carries for the insurer, what was checked in the period, what was found, and what was decided about it. It earns its keep twice. Examiners ask for it, because state law makes the insurer answer for its MGA and expects written proof of the reviews. And if a breach ends in a dispute, the file is the insurer's evidence of what it knew and when. The template below is built from what examiners have faulted and what courts have asked for, with one section for each, and breach notification as a section of its own. Botminds' Binding Authority Compliance fills most of it automatically: every breach arrives with its bordereau row, its clause and the search for written agreement already recorded, and every decision is stamped with a name, a time and a reason.

The worked examples use a fictional capacity provider, Corvane Specialty, and its fictional coverholder, Larkspur Underwriting Managers. The examination findings and court rulings are real and linked.

What is a delegated authority risk assessment?

A delegated authority risk assessment rates how much harm a delegate could do to the insurer and how well that risk is controlled, so that oversight effort goes where the exposure is. It is not the same as a breach log. A breach log says what went wrong; a risk assessment asks how likely it is to go wrong next quarter, and how big it would be.

The inputs are mostly facts the insurer already holds. How much of the binder's premium cap is used and how fast. Which classes and territories the delegate writes. Whether it settles claims, and up to what amount. How many breaches it produced per 1,000 risks, how serious they were, and how quickly it answered notices. What the last on-site review found. Two delegates writing the same premium can rate very differently on those facts, and the risk assessment should say why.

That chart is the core of section 2 for the sample insurer. Halberd Lowe writes the fewest risks and breaches most often, and is slowest to answer; its on-site review is booked for 27 October. Larkspur's rate is moderate for the year, but its September count jumped to seven from three in August, and two underwriters bound four of the six breaches on its property binder. A rating that used only premium volume would put Tamsin Ridge, the largest writer, at the top of the list. The breach rate says otherwise.

What evidence do examiners ask for on MGA oversight?

Examiners ask for proof that the insurer did what the MGA law requires, in writing, and they record it as a finding when the proof is missing. A 2025 California examination shows how specific the findings get. The insurer's MGA ran nearly every function of the program except reinsurance, yet the examiners found no fidelity bond, bank accounts owned by the MGA rather than the insurer, an agreement that allowed joint employment, no semi-annual on-site reviews and no written notice of the appointment to the Commissioner (California Department of Insurance, Topa Insurance Company, limited-scope examination as of 31 December 2023, filed 4 June 2025).

It is recommended the Company conduct such review at least semiannually as required, and maintain documentation to support the results of the reviews.

California Department of Insurance, examination of Topa Insurance Company, filed 4 June 2025

The second half of that recommendation is the template's reason to exist. A review that leaves no document behind cannot be shown to an examiner. Tennessee made the same point by order in 2021: adopting an examination report on Plateau Casualty Insurance Company, the Commissioner directed the company to start on-site reviews of its MGAs at least twice a year, within thirty days (Tennessee Department of Commerce and Insurance, order of 30 June 2021; the directive is quoted in MGA compliance audit). Neither finding was about an underwriting error. Both were about the insurer's inability to show oversight it was required to do.

For a market conduct examination more broadly, how to prepare for a market conduct examination covers the call letter and the document requests; the template here is the part of that response that concerns delegates.

What should a delegated authority risk assessment template include?

It should include the nine sections above, and each entry in them should point to its source rather than restate it. The test of a good entry is whether a stranger, an examiner two years later or opposing counsel, can trace it to the document behind it without asking anyone. The table shows the fields that make that possible for one breach, filled in from the sample September bordereau.

Why the detail per risk matters if a breach reaches court

Courts decide claims about delegated authority one risk at a time, and a file that describes problems in general terms can cost the insurer its claim. In 2025 the High Court in London ruled on applications in AmTrust's action against its former coverholder MDIS over latent defects policies written under a binder that ran from February 2011 to February 2020; AmTrust's claims of negligent underwriting and claims handling are allegations, not findings. The claim form was issued in April 2023, and AmTrust then sought to amend its case. The judge disallowed the disputed amendments except on the duty of care claim, explaining that "The lack of detail originally pleaded makes it very difficult for AmTrust to satisfy me" that the new claims arose on substantially the same facts (AmTrust Europe v MD Insurance Services [2025] EWHC 1468 (Comm)).

The lesson for the file is about specificity and time. A binder can run for nine years, and claims under it arrive for years after that. An insurer whose oversight file names each risk, the clause it breached, the evidence and the decision can plead a precise case years later. One whose file says "concerns about underwriting quality at the coverholder" has to rebuild the facts from scratch, after the limitation clock has been running. What one breach costs sets out the other half: what an insurer can recover, and from whom.

What is a binding authority breach notification?

A binding authority breach notification is the insurer's written notice to the delegate that a risk was bound outside the agreement, citing the clause, the risk and the figures, and asking for an answer and a remedy within the time the agreement sets. It is a contractual step, not a regulatory filing: the NAIC model act requires the insurer to notify the commissioner within 30 days of entering into or terminating an MGA contract, not when a binder is breached (Model #225, §5E). Whether a breach must be reported to anyone outside the insurer depends on the binder, the insurer's own policies and, in the London market, rules this page does not cover.

A good notice is short and complete. It names the bordereau file and row, quotes the clause, shows the arithmetic, states what the insurer's records show about agreement, sets the answer date under the binder's own clause and, where needed, asks the delegate not to bind similar risks in the meantime. The sample notice does each of those in under 150 words.

A breach notice drafted by Binding Authority Compliance, held until a person decides

What happens when a coverholder breaches its binder? The file's clock

When a coverholder breaches its binder, three clocks start: the time until the insurer finds out, the time until it decides, and the time the binder gives the coverholder to answer. The first is the one oversight controls, and it is the one that sets everything else. The timeline compares the sample breach as found from the bordereau with the same breach found at the coverholder's next on-site review.

The difference is not only the 37 days. A risk over the max line that runs unchecked for an extra five weeks is five more weeks of exposure the insurer never agreed to, and five fewer weeks to arrange a co-insurer or give notice of cancellation before a loss. And the bordereau lane leaves a record at every step: found 06:14, decided 08:42, notice sent, answer due. That record is section 4 to 6 of the template, written as the work is done rather than reconstructed for the examiner.

How do you document an MGA review?

Document an MGA review the way you would want to read it two years later: scope, method, evidence and outcome, each traceable. The scope says which binders, months and functions were covered. The method says how many files or lines were tested and how they were chosen; a review that sampled 14 files should say so, and say why 14. The evidence is the list of items tested with their source documents. The outcome is each finding, its severity, the action required, an owner and a date.

The FCA's 2025 review of outsourced claims arrangements is a useful warning about the evidence side. It found the management information most firms used to oversee these arrangements inadequate, and some firms without complete data for long stretches (FCA, 2025; see bordereaux data management). A review that relies on whatever management information the delegate chose to send inherits its gaps. A review that starts from every bordereau line, checked against the binder, does not.

The decision recorded: referred, with the reason and the time

Where Binding Authority Compliance fills the template, and where your team does

Binding Authority Compliance fills sections 3 to 7 as a by-product of the monthly check: bordereaux received and lines checked, each breach with its row, clause, arithmetic and agreement search, each decision with its author and reason, each notice with its answer date, and headroom on every cap and aggregate. The monthly authority compliance report it drafts, signed by the head of delegated authority and acknowledged by the chief underwriting officer, is a ready-made period summary for section 9.

Sections 1, 2 and 8 remain the oversight team's own: the licence and appointment records, the judgement behind the delegate's risk rating, the on-site review and its written results, the audited statements, the actuarial opinion and the bond. The solution supplies the facts a rating rests on, such as breaches per 1,000 risks and answer times, but the rating itself, like every decision in the file, is a person's. For the agents that produce the evidence and the limits written into each, see six agents, and what none may do; to try the template on one of your own binders, start from Binding Authority Compliance.

Questions people ask

How often should a delegated authority risk assessment be updated?

The monitoring sections should update with each bordereau, usually monthly; the risk rating at least before each on-site review, which the NAIC model sets at least twice a year and Florida at least once. A rating that is refreshed only annually will lag a delegate whose breach count jumps, as the sample coverholder's did from three in August to seven in September.

Should the template record breaches that were cleared?

Yes, with the reason and who cleared it. A cleared breach is still evidence of how the delegate binds and of how the insurer exercised its judgement. In Binding Authority Compliance a cleared breach stays on the audit trail but is not named in notices or the delegate's report.

What is the difference between a breach and a near miss?

A breach is outside the binder's terms; a near miss is inside but close to a limit. The sample insurer marks any line within 10% of a maximum line or aggregate as a notice. Near misses belong in section 2, because a delegate running at 95% of its line on many risks is a different risk from one that never comes close.

Can the delegate see the file?

The delegate should see what concerns it: each breach notice, the evidence behind it and the monthly report. The insurer's risk rating, internal debate and decisions about the relationship are its own. In the sample set-up the coverholder's compliance lead receives notices and the monthly report, and nothing else.

Is there an official delegated authority risk assessment template?

Not in US law. The NAIC model act and state statutes require the reviews and records but do not prescribe a form, and New York's insurance regulator has said its rule does not specify what an on-site review must include. The template on this page is our own, built from what examiners and courts have asked for.