An MGA compliance audit, in insurance, is the review an insurer must carry out of each managing general agent (MGA) that writes or settles business in its name, to confirm the agent is operating within its contract and the law; it is unrelated to the compliance audits the Malta Gaming Authority requires of its licensees, which share the initials. Most US states build the duty on the NAIC's Managing General Agents Act, whose text is blunt: "The insurer shall periodically (at least semi-annually) conduct an on-site review of the underwriting and claims processing operations of the MGA" (NAIC Model #225, §5C). Florida sets the clock at least annually instead. Examiners check that the reviews happened, and in 2025 California cited an insurer that had not done them. Botminds' MGA & Coverholder Audit is an agentic solution for these audits: agents test every risk and claim the MGA reports against the binder and draft the findings, and the insurer's auditor rates and signs, so each review leaves the record an examiner asks for.
The rule is short, but it varies in ways that matter: the review clock, whether a written report is required, and what happens to a new MGA in its first months. The table sets out the versions read for this guide, each linked to its source.
The MGA on-site review rule, state by state
| Jurisdiction | Review clock | What else the rule adds |
|---|---|---|
| NAIC Model #225, §5C | Periodically, at least semi-annually | Underwriting and claims processing operations, on site |
| New York, 11 NYCRR §33.6(c) | At least semi-annually | Regulation 120; the department’s counsel has said the regulation does not prescribe the review’s content |
| Minnesota, Stat. §60H.05 subd. 2 | At least semiannually | The insurer must “maintain on its records the results of that review” |
| North Carolina, G.S. §58-34-2(g) | At least semiannually | A written report on each review, available to the Commissioner on request |
| California, Ins. Code §769.84(c) | Semi-annual, as cited in a 2025 exam report | The examiners recommended documented results for each review |
| Tennessee, Code Ann. §56-6-505(c) | At least semiannually, as directed in a 2021 order | Compliance ordered within 30 days of the order |
| Florida, Stat. §626.7454(3) | At least annually | A new MGA reviewed within 6 months of engagement; the review duty does not apply to an MGA that is a controlled or controlling person |
What is an MGA compliance audit?
An MGA compliance audit checks three things at once: that the MGA kept to its contract, that the contract and the relationship meet the state's MGA law, and that the insurer itself did what that law requires of it. The first is about the book: risks inside the classes, territories and limits of the binding authority, rates inside the guide, claims paid inside the settlement authority. The second is about structure: a written contract with the required terms, a surety bond, premium held in a fiduciary account, no sub-MGA. The third is about the insurer's own duties, which include the on-site review itself.
The review is the insurer's, not a regulator's examination, though the two meet. A regulator examining the insurer tests whether the insurer's oversight works, and it can go further: under the model act, the MGA's acts count as the insurer's own, and the MGA may be examined as though it were the insurer (Model #225, §6; quoted in the NAIC Managing General Agents Act in plain words). How a company prepares for that regulator's examination is a separate job, covered by how to prepare for a market conduct examination.
How often must an insurer review its MGA?
At least twice a year in states that follow the NAIC model, and at least once a year in Florida, with a first review of a newly engaged MGA within six months. New York, Minnesota and North Carolina use the semi-annual clock, and California's and Tennessee's regulators cite semi-annual rules in their own orders. Florida's statute reads: "The insurer shall, at least annually, conduct an onsite review of the underwriting and claims processing operations of the managing general agent" (Fla. Stat. §626.7454(3)).
Two details trip carriers up. First, the clock attaches to each MGA, not to the insurer's delegated portfolio as a whole, so a carrier with 14 MGAs owes 28 reviews a year under a semi-annual rule. Second, Florida's first-review clock starts at engagement, which puts the first visit before the new delegate has produced a year of business to sample. A carrier writing through MGAs in several states can run every delegate to the strictest clock, so that one calendar serves all of them.
A new MGA's first year: two clocks for the same delegate
- Months 1–6Review by month 6
- Months 7–12Review by month 12
- First 6 monthsFirst review within 6 months
- Rest of yearThen at least annually
What does an MGA on-site review cover?
The statutes name the subject, "underwriting and claims processing operations", and leave the content to the insurer. When an attorney asked New York's insurance department what the semi-annual review must include, its Office of General Counsel answered that the regulation does not say; the review has to be enough to satisfy the insurer that the MGA is run properly and that the insurer has not handed over its own responsibilities (NY Office of General Counsel opinion 07-10-08, October 2007). In practice that means testing the business, not just touring the office.
Most programmes cover the same ground. On underwriting: risks bound inside the binder's classes, territories and limits, referrals approved before binding, rates and deviations, sanctions screening, policy issuance, premium remittance. On claims: notice and acknowledgement, coverage positions, reserving and reserve reviews, payments inside the settlement authority, the files the law sends to the insurer, recoveries. On the firm: licences, procedures, staff changes, business continuity, the trust account and the bond. A full test list, with the clause or statute behind each test, is in the MGA audit checklist.
How do examiners test an insurer's MGA oversight?
Examiners test the insurer's oversight by asking for its evidence: the MGA contracts, the dates and reports of each on-site review, the financial statements on file, and proof that the required notices were sent. In a financial condition examination, the MGA relationship is part of how the examiners understand the company's operations; in a market conduct examination, the NAIC's standards ask whether contracts with entities acting for the insurer, MGAs among them, comply with the law, and whether the insurer is adequately monitoring those entities (NAIC Market Regulation Handbook examination standards, operations and management standards 5 and 6).
State statutes give examiners direct reach into the money too. In Texas, an MGA holds premium as a fiduciary, and the department's examiners may audit that money directly (Tex. Ins. Code §4053.106). Error tolerances and sample sizes for the examiners' own testing are a different subject; the market conduct exam sample size calculator covers how examiners size their samples.
What an examiner can ask to see about each MGA
- The written contract
With the terms the state requires: accounts and remittance, fiduciary funds, records access, underwriting guidelines, claims provisions.
- The dates of every on-site review
Against the state’s clock, for each MGA, including a new MGA’s first review.
- The review reports and their evidence
What was tested, on how much of the book, what was found, and the results kept on record.
- Audited financial statements
Proving the MGA’s positive net worth, on file by the state’s date.
- The actuarial opinion
Where the MGA sets loss reserves, obtained annually.
- The bond
In force, in the right amount, for the insurer’s protection.
- Bank accounts for premium and claims
Held for the insurer, by the MGA as a fiduciary, not owned by the MGA.
- Notices to the commissioner
Of each appointment and termination, within the state’s deadline.
- The quarterly check of producers
Whether any producer has grown into an MGA under the statutory test.
What happens if an insurer does not review its MGA? California, 2025
It becomes an examination finding, and the missed reviews rarely come alone. California's Department of Insurance examined Topa Insurance Company as of 31 December 2023, in a limited-scope examination whose report was filed on 4 June 2025 (California Department of Insurance, Topa exam report). Topa had signed an agreement on 1 May 2023 with Swyfft, LLC, under which, the examiners wrote, Swyfft "performs nearly all business functions related to the operation of the policies issued under this program with the exception of reinsurance." The examiners found the company "did not comply with several areas of the Managing General Agent Act" and listed five.
The Company has not conducted semi-annual onsite reviews of the underwriting and claims processing operations of Swyfft as required by CIC Section 769.84(c).
California Department of Insurance, Report of Limited Scope Examination of Topa Insurance Company, filed 4 June 2025
The other four findings show what a regular review would have looked at. Swyfft "did not maintain a fidelity bond" for the company's protection; Swyfft, not the company, owned the bank accounts used to collect premiums and pay claims, where the law requires the funds to be held in a fiduciary capacity; the agreement allowed joint employment, which the statute bars; and the company "did not provide written notification to the Commissioner of the appointment of Swyfft as MGA". The examiners recommended semi-annual reviews, as the law requires, with documents to support each one's results (their recommendation is quoted in the delegated authority risk assessment template).
The program mattered to the company's results. The same report records that the company began writing a surplus lines property program with Swyfft in May 2023, mainly in the Southeast, and that the three hurricanes that hit Florida in the third quarter of 2024 affected the Swyfft book.
Tennessee, 2021: an order with a 30-day clock
Tennessee's insurance commissioner adopted an examination report on Plateau Casualty Insurance Company in June 2021 with two directives, the second of which reads: "The Company is DIRECTED to comply with Tenn. Code Ann. § 56-6-505(c) by conducting on-site reviews of its Managing General Agents at least semiannually." The company had to comply "within thirty (30) days of its entry and execution", and the order states that adopting the report did not stop the department from imposing sanctions for potential violations the report revealed (Tennessee Department of Commerce and Insurance, order adopting examination report, June 2021).
The two cases make the same point from different directions. In California, the missing review travelled with missing controls over bond, money and notice. In Tennessee, the review itself was the directive. Either way, the evidence an insurer needs is a dated review report for each MGA, built on testing that can be shown.
Why the rule exists
The rule exists because handing an outside firm the pen has a long history of going wrong. New York's regulation opens with the reason: delegated authority had been abused, to the harm of insurers and policyholders alike (11 NYCRR §33.0; quoted in the NAIC Managing General Agents Act in plain words). The NAIC model's answer is to keep the duty with the insurer: contract terms that give it access to the MGA's records in a usable form, money held as a fiduciary, and a review on site, at a fixed rhythm, of the two functions where delegation can do the most damage.
What the rule does not do is say how much to test. A review that walks through procedures and pulls a handful of files satisfies the calendar; whether it would have found three risks bound over the limit is another question, and the subject of how accurate a sample-based audit is.
Is the MGA review semiannual or annual? One calendar for every delegate
Semiannual in most states that follow the model, annual in Florida; the safe practice is a single calendar that meets the strictest rule for each delegate. That calendar is also an examiner's first exhibit: which MGAs, which dates, which opinions, which actions still open. A delegate that is new, or that had a poor last opinion, earns an earlier slot.
One audit plan for every delegate, with the last opinion and open actions
What the review file should hold when the examiner asks
The review file should show what was tested, how the files were chosen, what was found, who rated it, and what happened next. Minnesota requires the insurer to keep the results on its records; North Carolina requires a written report available to the Commissioner; California's examiners asked for documentation to support the results. A one-page visit note does not meet that bar. A report with scope, opinion and rated findings, each finding citing the files and clauses it rests on, does.
In Botminds' MGA & Coverholder Audit, every finding links to the whole-book test and the files behind it, every test step cites a document and page, and the sampling memo records the weights and the random seed. The audit trail is kept for the life of the binder plus seven years, a setting each carrier can lengthen. None of it changes who is responsible: the auditor sets the ratings and signs, and the insurer answers for the review.
A review report an examiner can follow from finding to file
Questions people ask
Is an MGA compliance audit the same as a market conduct exam?
No. The MGA compliance audit is the insurer's own review of its delegate. A market conduct examination is the regulator's review of the insurer, which may include how the insurer oversees its MGAs. The first is the evidence the second asks for.
Can the review be done remotely?
The model act, New York, Minnesota, North Carolina and Florida all say "on-site" or "onsite". Remote testing of bordereaux and files can do most of the work beforehand, but the statutes read for this guide do not replace the visit; an insurer relying on a remote review should check with its regulator.
Does the on-site review rule apply to coverholders in London?
Not as a statute. The US rule binds insurers licensed in states that adopted the MGA act. In the UK, the FCA and PRA expect firms to oversee delegated authority arrangements, and the FCA is reviewing firms' oversight of outsourcers and delegated authority models, aiming to report its findings in early 2027.
Who should perform the review?
The insurer, through people independent of the MGA relationship's sales side: usually a delegated authority audit team, with claims and underwriting specialists for the files. The model act names the duty, not the reviewer's qualifications.
Does a captive or affiliated MGA need a review?
It depends on the state. Florida's review duty does not apply to an MGA that is a controlled or controlling person, and the NAIC model excludes some affiliated underwriting managers from the MGA definition altogether. Check the definitions in the statute that applies before dropping a review.
How long should review records be kept?
The model act leaves record retention to each state's own statute. In the fictional sample setup, audit records are kept for the life of the binder plus seven years; a carrier should set its own period from the retention laws of the states where it writes.