A TPA claims audit checklist is the list of tests a carrier's auditor runs on the claim files a third-party administrator handles for it: first contact and file movement, coverage, reserves, settlement authority, payments, reporting to the carrier, and the controls around them. The twenty checks below cover those six families, each with the file event that proves it. A checklist alone has a blind spot, though. It says what to look at, not whether the review actually finds what is there, and an audit that reads a few hundred files cannot report on the thousands it did not open. The fair test of any review, a person with a sample or software reading every file, is to plant known errors in closed files and count what comes back. Botminds' Delegated Claims Audit, a claims oversight solution for carriers that checks every file event a TPA posts, should be held to the same test.
Examples come from a fictional sample carrier, Harrowgate Specialty, and its five fictional administrators. The audit rules come from NAIC model laws and state statutes; the measurement logic from the US audit standard on sampling and the FCA's 2025 review of outsourced claims.
A seeded test of twenty planted errors, spread by check family
What should a TPA audit checklist include?
It should include a test for every obligation in the claims administration agreement that can be seen in the file, and for every statutory trigger that obliges the administrator to tell the carrier something. In practice that is six families: contact and diary, coverage, reserves, authority, payments and reporting. Each check below names what to compare and with what; a check that cannot be answered from the file is a question for the interview, not the file review.
Twenty checks for a TPA claims audit, in six families
- First contact within the agreed clock
Compare the first-notice date with the first contact note. In the sample carrier the clock is one business day.
- No file idle past the diary limit
Days since the last activity against the agreement’s limit (30 days in the sample).
- Acknowledgement and status letters sent
The letters the agreement and state law require, dated, on the file.
- Policy in force on the loss date
Policy period against the date of loss, from the policy, not the adjuster’s summary.
- Cause of loss covered under the binder
The binder’s coverage terms and exclusions against the loss description.
- Deductibles and sublimits applied
Each payment against the deductible and any sublimit, such as mould or spoilage.
- No coverage position without the carrier
Reservations of rights, declinations and declined tenders against the carrier’s written agreement.
- Initial reserve set on time
Notice date against the first reserve (five business days in the sample).
- Reserve reviewed after new information
Each estimate, demand or report against the next reserve change (ten business days in the sample).
- Reserve never below paid
Paid to date against the reserve, where the agreement defines the reserve as the expected total cost.
- Reserve within tolerance of the latest estimate
The gap between reserve and the latest estimate, against the agreement’s tolerance (15% in the sample).
- Indemnity paid or reserved within authority
The total against the binder’s indemnity limit; anything above needs a referral on file.
- Expense within its own authority
Expense is often limited separately from indemnity; test it separately.
- Referral and approval on file before payment
The carrier’s written approval dated before the payment that needed it.
- Payee on the approved vendor list
Payee name and tax details against the list.
- Invoice arithmetic correct
Line totals, taxes and the invoice total against the amount paid.
- No invoice line paid twice
Every line against every prior payment on the claim, not just the last invoice.
- Large losses notified on time
The date the claim was likely to pass the notice threshold against the notice date.
- Suits, coverage disputes and six-month claims notified
The statutory and contractual triggers, each with its own date met.
- Bordereau agrees with the file
Paid and reserved on the monthly line against the file’s own payment and reserve history.
Two neighbouring checklists cover ground this one deliberately leaves out. Whether each step of a claim would satisfy a market-conduct examiner under unfair-claims-practices rules is covered in the claim file audit checklist for carriers' own desks, and whether an independent adjuster's bill matches the work on the file is the subject of the claims audit checklist for adjuster bills.
What is a TPA claims audit, and what does the law require?
A TPA claims audit is the carrier's periodic review of an administrator's claims operation and a sample of its files, to confirm the administrator is working within its authority and the agreement. For some delegates the law sets its frequency. The NAIC's TPA guideline, written for life, annuity, health and stop-loss administration, requires an insurer to review a TPA serving more than 100 people at least semiannually, with at least one review on site, at the insurer's own cost. Florida's statute for life and health administrators adds that the insurer may contract with a qualified third party to conduct the review. Texas asks for a semiannual review and, under the section as amended in 2025, an audit at least biennially.
For property and casualty claims handled by an MGA, the model act requires an on-site review of the MGA's claims processing operations at least semiannually. For a P&C claims TPA that is not an MGA, the frequency usually comes from the contract. Examiners have faulted carriers for doing less than the rule asks; one state found a carrier could produce only one TPA audit a year where two were required, a case set out in claims audit software for insurance companies.
How often should a TPA be audited?
At least as often as the state rule for that kind of delegate, and more often where the risk is higher: a new administrator, a binder with high authority, a run of late notices or a scorecard falling. The floors are semiannual for an MGA's claims operation under the model act and for a life or health TPA serving more than 100 people. Florida's MGA rule is annual, with a first review within six months of engaging a new MGA.
A frequency answers the wrong question if the review itself is weak. Twice a year, a sample of 250 files from an administrator with 1,400 open claims, the size of the largest in the fictional sample, leaves most files unread between visits. The questions that matter are what each review can detect, how quickly, and how anyone would know.
Why a checklist is not a test
A checklist describes the procedure; it says nothing about how often the procedure catches what it is aimed at. Auditors separate two kinds of risk. Sampling risk is the chance that the files read are not representative of the files not read. The other kind is subtler, and the US audit standard on sampling states it plainly:
Reading every file removes the luck of the draw. It does not remove the chance that the reader is wrong.
That is nonsampling risk, which the standard says includes "the possibility of selecting audit procedures that are not appropriate to achieve the specific objective." It applies to software as much as to people. A tool that reads every file can still apply a check badly: compare an invoice only with the previous one and miss a line paid three months earlier, or read a reserve as outstanding when the agreement defines it as total incurred. Reading every file removes sampling risk. Only testing the reader removes the doubt about the reader.
How do you audit a TPA's review? Plant twenty errors in closed files
Take a set of closed files whose correct answers you already know, change twenty of them in specific, documented ways, and run the review on the whole set without telling the reviewer which files were altered. Every planted error is a question with a known answer. The table shows a seeding plan drawn from the statutory triggers, the FCA's findings and the sample carrier's own flags.
Part of a seeding plan: how each error is planted, and what counts as found
| Planted error | How it is planted | Counts as found when |
|---|---|---|
| Duplicate invoice line | Repeat a drying line from a July invoice inside an October invoice on the same claim. | The finding names both invoices and the repeated line. |
| Paid above authority, no referral | Add a payment taking indemnity paid from $41,000 to $56,000 on a $50,000 binder; remove the referral. | The finding states paid against authority and that no referral is on file. |
| Reserve stale after an estimate | Insert a contractor estimate 60% above the reserve and leave the reserve unchanged for 15 business days. | The finding dates the estimate and the missed review. |
| Large loss not notified | Raise an estimate above the notice threshold and leave no notice on file. | The finding gives the date the trigger was met and the notice due date. |
| Open more than six months, not reported | Backdate a file’s opening by seven months, keep it open, no report. | The finding cites the six-month trigger. |
| Deductible not taken | Remove the deductible from a spoilage payment. | The finding prices the deductible. |
| Declination without the carrier | Insert a declination letter with no carrier agreement on file. | The finding names the letter and the missing agreement. |
| Clean control files | Leave twenty other files untouched. | Nothing is flagged on them; any flag is a false alarm. |
The design choices matter. Plant errors where your audits have historically found them and where the money is, not where they are easiest to spot. Spread them across administrators and binders. Include clean control files, because a review that flags everything will score perfectly on detection and be useless in practice. And plant at least one error that needs two documents to see, such as a duplicate split across invoices months apart, because that is the kind a sampled read misses most.
Scoring it: found, missed and flagged in error
Score three numbers and one time. Detection: how many of the twenty planted errors the review found, with the right reason. False alarms: how many clean files it flagged. Precision of the explanation: whether each finding cited the evidence. And time: how long after the planted event the finding appeared.
Four numbers that score any TPA claims review, Delegated Claims Audit included
Detection
errors found with the right reason ÷ errors planted
Count a finding only if it names the right check and evidence. 18 of 20 is 90%.
Claims auditor
False alarms
clean files flagged ÷ clean files
A review that flags every file finds every error and helps no one.
Claims auditor
Evidence
findings citing the file note and rule ÷ findings
A finding a TPA cannot check is a finding it will dispute.
Head of delegated claims
Time to find
finding date − date the error entered the file
Months for an annual sample; minutes for checks on each event.
Head of delegated claims
Setting the pass mark: what the FCA found about tolerances
A seeded test needs a pass mark set before the results are in, and most oversight programmes are weak at exactly that. In its 2025 review of 23 insurers that outsource claims, the FCA found that 11 could evidence appropriately set, reviewed tolerances for their claims information, and that 12 had shortcomings in how they set them. Among the failures it listed thresholds with no quantitative basis and reliance on one person's judgement instead of defined tolerances. One finding should be pinned above every oversight team's desk: RAG rating thresholds "were sometimes set too low, providing a false sense of assurance to stakeholders."
For a planted-error test, write down before the run what detection rate you would accept from your current audit, what false-alarm rate your team can absorb each week, and what time to find you need for each family. An authority breach found in minutes is worth more than one found at month-end; a late diary entry found at month-end may be fine.
Running the test on agents and people alike
The same seeded set should go through the current audit process and through any software under consideration, so both are scored on identical files. In Delegated Claims Audit a changed check can be run on past file events before it goes live, which makes a seeded run a routine step rather than a project. In the fictional sample, September's 36,904 file events were compared with the 412 files the claims auditor had reviewed: the checks missed none and flagged six in error, each a referral sent by email and attached to the file late.
In Delegated Claims Audit, each check quotes its clause and can be tested on a past month
Six false alarms out of 412 is a sample figure from fictional data, not a promise. What the method promises is that you will know your own numbers. A team that runs the seeded set each quarter will also see drift: an administrator changing how it records referrals, a binder with new terms, a check that needs its rule updated. Where the errors cost money, measuring claims leakage on the same files turns detection into dollars.
What a week of real-time findings looks like against the checklist
The method also says something about how to read any vendor's accuracy claim, including ours. Ask what set it was measured on, who planted the errors, how clean files were scored, and whether the set reflected your binders. How to run that comparison as a structured trial on one administrator is set out in a one-TPA pilot of claims oversight software.
Questions people ask
What is a claims file audit?
A claims file audit is a review of individual claim files against the rules that govern them: the contract, the authority schedule, statute and internal standards. For a TPA, it usually reads a sample of open and closed files on site or by remote access. Its findings feed the administrator's scorecard and any recovery the carrier pursues.
How do you audit a TPA?
Request the administrator's file list and controls documentation, select files, test each against a checklist like the one above, interview the claims leadership, and agree findings and actions with a date. Then measure the review itself: a planted-error test on closed files shows what the process catches and what it misses.
What are TPA claims audit requirements?
They depend on the line and the state. The NAIC's TPA guideline requires a semiannual review of life, annuity, health and stop-loss administrators serving more than 100 people, at least one on site. Texas adds an audit at least every two years. P&C claims administrators are usually governed by contract unless they are MGAs, which the model act reviews semiannually.
How many files should a TPA audit test?
Enough to estimate the error rate you care about with the confidence you need, which for rare, costly errors is more than most audits read. Sample-size arithmetic is set out in the claims audit sample size calculator; the planted-error test answers a different question, which is whether the reading itself is reliable.
Can software replace a TPA audit?
It can replace the file reading, not the audit. An on-site review still tests people, controls, training and systems that no file shows, and the law asks for one. Software that checks every file event means the auditor arrives knowing which files failed which checks.