An MGA audit checklist is the list of tests an insurer runs when it audits a managing general agent: whether the contract and licences are in order, whether premium and claims money are held and remitted as the law and the binder require, whether each risk was written inside the binding authority's classes, territories, limits and rates, whether claims were reported, reserved and paid inside the settlement authority, and whether the insurer itself met its statutory duties. The checklist below has 32 tests, most taken directly from the NAIC's Managing General Agents Act, each with its source, so that every finding can say which rule it breaks. It is written for insurance delegates (the abbreviation also names Malta's gaming regulator, whose licensee audits are a different subject). Botminds' MGA & Coverholder Audit is an agentic solution that runs a checklist like this one on every risk and claim a delegate reports, tests each sampled file against its documents, and drafts the findings for the auditor to sign; the eight-week plan below is how a carrier can put it to work on one delegate first.
The examples use the solution's fictional sample audit of Bayline Coastal Underwriters, a commercial property MGA, by its carrier, Harrowgate Specialty. The plan's weeks are our recommendation, not a measured result.
From checklist to a first delegate audited on its whole book: eight weeks
- Scope, binder and rating matrixWk 1 scope
- Tests read from the binderWk 2 tests
- Back-test on a closed periodWk 3 back-test
- Calibrate and sign off the methodWk 4 calibrate
- Information requestWk 5 request
- Whole book, sample, filesWk 6 testing
- Visit and draftWk 7 visit
- Issue, actions, reviewWk 8 issue
What should an MGA audit checklist include?
It should include every term of the binding authority that can be tested, every duty the state's MGA law puts on the MGA and the insurer, and the carrier's own rules, each as a yes-or-no test with its source. The NAIC model gives the backbone. The contract must exist before business is placed: in most states, NAIC's licensing handbook notes, an MGA may not place business until every party has signed a written contract (NAIC State Licensing Handbook, chapter 24, September 2026 draft). The contract must carry underwriting guidelines on premium volume, rates, risk types, limits, exclusions, territories, cancellation and policy period, and, where the MGA settles claims, must send the claim file to the insurer when it "May exceed the MGA’s claims settlement authority" (NAIC Model #225, §4F and §4I).
The binder adds the numbers: the per-location limit, the aggregate cap, the rating credit allowed before a deviation, the settlement authority, the remittance days. The carrier adds its own rules, such as screening before binding. The 32 tests below are grouped by area.
An MGA audit checklist: 32 tests and where each comes from
| Test | Area | Source |
|---|---|---|
| Written contract in force before any business is placed | Contract | Model #225 §4 |
| Contract carries the required terms: termination for cause, monthly accounts, fiduciary funds, records access, no assignment, guidelines, bond, claims | Contract | Model #225 §4A–M |
| MGA licensed as a producer where it acts | Contract | Model #225 §3 |
| No sub-MGA; producers it appoints are licensed for the business | Contract | Model #225 §4M(3), (8) |
| No individual jointly employed by the MGA and the insurer | Contract | Model #225 §4M(7) |
| Commissioner notified of appointment or termination on time | Contract | Model #225 §5E (30 days); state law |
| Funds held as a fiduciary in an FDIC-insured account used for the insurer’s payments, not owned by the MGA | Money | Model #225 §4C |
| Accounts rendered and funds remitted at least monthly, and on the binder’s terms | Money | Model #225 §4B; binder |
| Claims float within the cap: three months under the model, 60 days in Florida | Money | Model #225 §4C; Fla. Stat. §626.7451(3) |
| Premium declared on the bordereau matches premium received in the account | Money | Binder; fiduciary duty |
| Surety bond in force for the insurer: at least $100,000 or 10% of prior-year premium, at most $500,000 | Money | Model #225 §4G |
| No interim profit paid before the hold-back period and verification | Money | Model #225 §4L |
| Each risk in an authorised territory | Underwriting | Model #225 §4F(f); binder schedule |
| Each risk in an authorised class, or referred and approved before binding | Underwriting | Model #225 §4F(c); binder schedule |
| Limits within the maximum, or referred and approved before binding | Underwriting | Model #225 §4F(d); binder schedule |
| Aggregates within their caps, such as a catastrophe zone | Underwriting | Binder schedule |
| Premium volume within the annual maximum | Underwriting | Model #225 §4F(a) |
| Rates on the agreed basis; deviations documented and approved | Underwriting | Model #225 §4F(b); rating guide |
| Exclusions, cancellation provisions and maximum policy period applied | Underwriting | Model #225 §4F(e), (g), (h) |
| Sanctions screening done before binding | Underwriting | Insurer’s rules; binder |
| All claims reported to the insurer in a timely manner | Claims | Model #225 §4I(1) |
| File sent when a claim may exceed the MGA’s settlement authority | Claims | Model #225 §4I(2)(c) |
| File sent when a claim involves a coverage dispute or is open more than six months | Claims | Model #225 §4I(2)(b), (d) |
| Payments within settlement authority; none over the surplus cap without approval | Claims | Model #225 §4M(4); claims agreement |
| Reserves set and reviewed on new information within the agreed days | Claims | Claims agreement |
| Claims acknowledged within the agreed days | Claims | Claims agreement |
| Claims bordereau matches the file and the payments made | Claims | Binder; claims agreement |
| Recoveries (subrogation, salvage) considered and pursued | Claims | Claims agreement |
| Separate records, accessible to the insurer in a form it can use | Records | Model #225 §4D |
| Bordereaux complete, on time and in the agreed format | Records | Binder |
| Insurer holds audited statements proving positive net worth, and an actuarial opinion where the MGA sets reserves | Insurer | Model #225 §5A, §5B |
| Insurer reviewed the MGA on site on the state’s clock, with the results kept | Insurer | Model #225 §5C; state law |
Why every test needs a source column
A finding without a rule is an opinion, and a delegate can argue with an opinion. The law does not hand the insurer a ready-made programme either. When an attorney asked New York's insurance department what an insurer's semi-annual MGA review had to contain, its counsel answered: "Regulation 120 does not specifically direct what an insurer must do to comply with 11 NYCRR § 33.6(c)" (NY Office of General Counsel opinion 07-10-08, October 2007). Texas requires the MGA contract to address "reports, records, and auditing" (Tex. Ins. Code §4053.102) but leaves the content to the parties. The checklist is where the insurer turns those open duties into tests it can show.
The source column also makes a checklist portable. When a delegate writes in Florida, the claims float test reads 60 days rather than the model's three months, because Florida's statute lets the MGA hold no more than 60 days of estimated claims payments and allocated loss adjustment expenses (Fla. Stat. §626.7451(3); quoted in premium remittance meaning). A test that cites its source is a test someone can update when the law changes.
A finding without a rule is an opinion. A checklist with a source column turns every finding into a citation the delegate cannot argue away.
MGA compliance audit checklist or MGA audit checklist: two layers in one list
A compliance checklist tests the relationship against the statute; an audit checklist tests the business against the binder; a working programme needs both in one list. The first layer is mostly annual and structural: contract, licences, bond, notices, accounts. The second runs on every record: each risk, each premium, each claim. Many programmes do the first well and the second on a sample, which is where the breaches hide.
The money tests are where both layers meet, and where checklists are often thin. California's 2025 examination of one insurer found that its MGA, not the insurer, owned every bank account used to collect premium and pay claims (California Department of Insurance, Topa exam report, filed June 2025), a structural failure no file sample would show. And in a 2022 English case, the coverholder's bordereaux showed premium of more than €4 million received in the first half of 2016 while its premium accounts held nothing or very little (XL Insurance v IPORS, [2022] EWHC 2093 (Comm)). Tests 7 and 10 in the checklist exist for those two failures. What the on-site review must cover state by state is in the MGA compliance audit guide.
How do you build a delegated authority audit programme?
You build it from seven parts, in this order: an audit plan that says which delegates are due when; a scope per delegate; the checklist, with each test's source; the limits read from each binder; a sampling plan for the files; a rating matrix with fix-by days; and a report template whose findings carry condition, criteria, effect and recommendation. Rules for actions come last: who owns them, when they are chased, who accepts closure, and what happens when an exception returns. An underwriting audit inside a carrier uses a similar structure for its own underwriters, set out in the underwriting audit checklist.
Every part is a decision the carrier makes once and then changes rarely. In the fictional sample setup, High findings must be fixed within 30 days and approved by the head of delegated authority before issue, Medium within 60 and Low within 90; the same theme at two audits running raises the rating one level; the sample is 30 risk-weighted files and 6 random, with up to four exception files per test and at least one file per state. Those are Harrowgate's settings, not anyone's standard.
What data does each test need?
Most tests need four things: the binder with its schedules and endorsements, the bordereaux for the period, the files behind them, and the money. Missing any one leaves a block of tests that cannot run, which is why the information request matters more than it looks. In the sample audit the request ran to 41 items, with the sampled files requested once the sample was drawn.
The data an MGA audit checklist needs on day one
- The binding authority, all schedules and every endorsement
The limits change by endorsement; a test against last year’s schedule is a wrong test.
- The claims handling agreement
Settlement authority, reserve review days, acknowledgement days, referral rules.
- Risk and premium bordereaux for every month in the period
In whatever layout the delegate sends; the tests need them in one shape.
- Claims bordereaux for the same months
Every claim, reserve and payment, with dates.
- Trust or fiduciary account statements
Premium in against premium declared; claims paid out against claims reported.
- Procedures, licences, staff changes
What the delegate said it would do, and who was allowed to bind and settle.
- The last audit’s report and actions
What was found, what was promised, what was closed and on what evidence.
- Read-only access to sampled files
Applications, referral logs, rating worksheets, screening logs, claim notes, payments.
Live in eight weeks: the plan, week by week
Weeks one to four set up the method on a period you have already audited, so you can compare it with what your team found by hand. Weeks five to eight run it live on the same delegate's current period, through the visit and the report. Choose a first delegate whose bordereaux arrive reliably and whose last audit raised findings, so the back-test has something to find.
Week 1, scope. Agree the delegate, the period and the scope; collect the binder, schedules, endorsements, claims agreement, last report and actions; set the rating matrix and report template. Week 2, tests. Read the limits from the binder into the tests, each citing its clause; confirm the checklist's tests against the state's statute; set the sampling plan. Week 3, back-test. Run the whole-book tests on the last closed period's bordereaux and compare the exceptions with that audit's findings: what both found, what only the tests found, what only the auditor found. Week 4, calibrate. Clear the false alarms with reasons, adjust thresholds, and let internal audit read the sampling memo before anything is live.
Week 5, request. Send the information request for the current period to the delegate's named contact, approved by the auditor. Week 6, testing. Whole-book tests on arrival, the sample drawn and locked, the files tested against their pages. Week 7, visit. Interviews and walk-throughs on the exceptions; the draft report, with High findings to the head of delegated authority. Week 8, issue. The report issued, actions agreed with owners and due dates, and a short review: auditor days against your baseline, findings against the back-test, and which delegates go next.
Who is needed for the eight weeks
Today
Owns a spreadsheet programme that lives in one person’s head.
With agents
Owns the scope, the rating matrix and the sampling plan as written settings.
Still theirs: Sign-off on the method
Today
Builds each audit from last year’s workpaper.
With agents
Runs the back-test, reviews every exception, conducts the visit.
Still theirs: Ratings and the signature
Today
Sees the report after it is written.
With agents
Approves High findings before they reach the delegate.
Still theirs: Approval and renewal decisions
Today
Reviews the programme after the fact.
With agents
Reads the sampling memo in week 4, before go-live.
Still theirs: Independent challenge
Today
Receives a long request and a late report.
With agents
Receives one request, then the exact files behind each finding.
Still theirs: The delegate’s response
How long does it take to set up an MGA audit programme?
On our plan, eight weeks to the first delegate audited on its whole book, of which four are set-up done once. After that, each new delegate needs its binder read into tests and its bordereaux layout recognised, then joins the calendar. The calendar itself is fixed by law in most US states: an on-site review of each MGA at least twice a year under the model act, at least yearly in Florida, so a programme of 14 delegates is 28 audits a year under the stricter rule.
The longest pole is usually not the software but the binder: endorsements filed in email, schedules with limits written in prose, a claims agreement nobody can find. The back-test in week 3 is where those surface, and it is better that they surface there than at the visit.
Where Botminds' MGA & Coverholder Audit runs the checklist, and where people do
The solution runs the record-level tests on every risk and claim, and the file-level tests on every sampled file. In the sample audit, the file tester reads each file's documents and ticks its eight steps one by one against cited pages: loss inside the policy period, acknowledgement on time, reserve reviewed, payment inside authority, payee screened, bordereau matching the file. It never passes a step without a cited passage and never guesses a missing document. The structural tests on the contract, bond, licences and notices are evidence the auditor reviews from the information request.
Each step of each file, tested against a cited page
What stays with people: approving the request before it goes, clearing any exception, deciding a file's step on judgement, setting ratings, the visit and the signature. A claim file shows why. The file below fails one step, a payment over authority, and the claim note gives the adjuster's reason. Whether that reason makes it a Medium or a High is the auditor's call.
A failed step, with the page that proves it and the note that explains it
The reserve of $64,000, set on 22 August, already exceeded the $50,000 authority. Under the model act, a claim that 'may exceed' the authority is when the file should reach the insurer: a test worth adding to any checklist.
Questions people ask
What is an MGA audit?
An MGA audit is an insurer's review of a managing general agent's underwriting, claims, money and records against the binding authority and the state's MGA law. In US states that follow the NAIC model it includes an on-site review of underwriting and claims operations at least twice a year.
Is there an MGA audit checklist template?
The table on this page is one, with sources. Use it as a starting point and replace the model act references with your state's sections and the binder's own clauses, so each test cites the exact rule your delegate signed up to.
How many tests should an MGA audit have?
As many as the binder and statute give you testable terms, and no more. The 32 here cover a typical property and casualty binder with claims authority; a binder without claims authority drops eight, and a binder with catastrophe aggregates, reinsurance or profit commission adds its own.
Which tests can run on every record, and which need the file?
Tests on fields the bordereau carries (territory, class, value, dates, amounts) can run on every record. Tests that need a document (referral approved, deviation signed, coverage position in writing, claim note) need the file, which is why the files are sampled from the record-level results.
What is the most common MGA audit failure?
There is no published count, so no honest single answer. The public exam reports read for these guides point at oversight itself: missed on-site reviews, missing bonds, bank accounts in the MGA's name and notices never sent, all in one 2025 California report.
Should the checklist include the insurer's own duties?
Yes. Examiners test the insurer, not only the MGA: audited statements on file, the actuarial opinion where the MGA sets reserves, the on-site review on time, notices to the commissioner. Putting them in the same checklist means the evidence is ready when the examiner asks.