Premium audit vendors are independent firms that carry out workers' compensation and general liability premium audits on a carrier's behalf: they contact the insured, examine payroll and disbursement records, propose classifications and subcontractor additions, and return a signed audit worksheet for the carrier to rate and bill. Regulators accept the arrangement; the NAIC's examination standard asks examiners only to verify whether a carrier's own auditors or independent auditors do the work. What a carrier cannot outsource is the responsibility. The examination standards, the state audit rules, the duty to explain the bill, the refunds and the penalties for poor audit quality all run to the insurer, so the carrier must still decide which policies are audited and how, check the vendor's work, and keep the evidence. Botminds' Premium Audit Automation is built for the carrier's side of that line: it prepares and cites every audit so the auditor, whether staff or a vendor's, decides and signs on a file the carrier holds.
This guide names no vendors and ranks none. The rules are quoted from the NAIC, Oregon's, Florida's and Delaware's insurance regulators and New York's financial regulator, linked where they appear; examples come from a fictional sample carrier in the solution.
Who holds each step of an outsourced premium audit, and who answers for it
| Step | Who can hold it | Who answers for it |
|---|---|---|
| Decide which policies are audited, and which waived | Who can hold itCarrier | Who answers for itCarrier. Examiners verify the waiver procedure and that its basis is reasonable. |
| Choose the audit method for each policy | Who can hold itCarrier sets the rule; vendor follows it | Who answers for itCarrier. Florida and Oregon set physical and field audit minimums by premium and class. |
| Request records and chase the insured | Who can hold itEither | Who answers for itCarrier. Attempts and their basis belong on the carrier’s file. |
| Examine records and reconcile payroll | Who can hold itVendor auditor | Who answers for itCarrier. Oregon’s audit procedure rule binds the insurer, whoever does the work. |
| Propose classes and subcontractor additions | Who can hold itVendor auditor | Who answers for itCarrier. The premium must rest on filed rates and the correct classes. |
| Sign the audit | Who can hold itThe auditor who did it | Who answers for itAuditor and carrier. Florida requires the auditor’s signature and proof of identification. |
| Rate, bill and explain | Who can hold itCarrier | Who answers for itCarrier. Oregon defines what a final premium audit billing must contain. |
| Refund return premium | Who can hold itCarrier | Who answers for itCarrier. Examiners independently verify refunds reach insureds on time. |
| Answer disputes, hearings and test audits | Who can hold itCarrier, with the vendor’s file | Who answers for itCarrier. Oregon’s test audit standard and penalties fall on the insurer. |
What do premium audit vendors do?
They supply auditors. A carrier sends a vendor a list of expired policies with the policy information; the vendor's auditors contact each insured, perform a field, desk or mail audit as the carrier instructs, and return the worksheet, the records reviewed and the auditor's notes. A vendor may also handle scheduling and record requests, or audit only in certain regions or industries. The carrier then rates the audited exposure, issues the bill and handles what follows.
The arrangement is common enough that regulators write it into their checks. The NAIC's standard 9 review procedures include: "Verify if all auditable commercial policies’ auditors or independent auditors conduct audits." Florida's rule assigns the classification duty to "Each voluntary market carrier or the National Council on Compensation Insurance", not to whichever firm sent the auditor. The question is never whether a vendor may audit, but whether the carrier can show the audit was done right.
Should we outsource premium audits?
Outsource for capacity and geography; keep control of the rules, the decisions that move premium, and the file. Audit work arrives in waves after expirations and needs physical visits where the rules require them, which is why carriers use vendors: Florida requires physical audits on voluntary-market policies of $10,000 or more and on every new construction policy, and Oregon requires annual field audits at $10,000 or more of annual standard premium. A vendor with auditors near the insureds can meet those rules at a cost a carrier with a central team may not.
The costs are less visible. Classification decisions made by many outside auditors drift apart unless someone checks them. The insured's experience, the speed of refunds and the quality of the letter that explains a bill depend on handoffs between two organisations. And the audit file, the thing an examiner, a hearing officer or a court will ask for, may sit in the vendor's systems. None of these is a reason not to outsource. Each is something to put in the contract and measure.
What stays with the carrier when audits are outsourced?
Everything a regulator measures. The NAIC's operations standards expect an insurer to have contracts with anyone "assuming a business function or acting on" its behalf that comply with applicable requirements, and to be "adequately monitoring the activities of any entity that contractually assumes a business function or is acting on behalf of the regulated entity." Under standard 9 the carrier must still show a structured audit system, a reasonable waiver basis, a completion time frame and timely refunds.
Oregon makes it explicit. Its rule says "Each insurer shall develop audit procedures that include all of the features described in this rule", from reconciliation to overtime to the standard exception codes. If an insurer's test audit results fall short for six consecutive quarters, it is the insurer that meets the director, and if it still fails, the director may penalise it, up to suspending its certificate of authority (Oregon's audit standards, set out in premium audit standards). The director can even prescribe an audit review program for the insurer while it fixes the problem. A vendor's error is the insurer's error in Oregon's arithmetic.
Florida does the same in its own way. When the state finds an employer misrepresented payroll or duties, the carrier must begin a physical onsite audit within 30 days, and if it fails to, "the department shall contract with auditing professionals to conduct the audit at the carrier’s expense." The billing obligations are the carrier's too: Oregon defines the elements of a final premium audit billing, and Delaware's 2026 bulletin expects carriers to give insureds the full calculation and to refund overpayments directly.
How do you oversee a premium audit vendor?
Re-audit a sample of the vendor's work against a stated tolerance, and watch the measures an examiner would. Oregon's own test audit design is a ready model: a random sample from the whole book each quarter, an error defined as a premium difference over $500 or two percent of standard premium, whichever is greater, and an error ratio tracked over six quarters. Apply it to each vendor separately, and to your in-house auditors as a control.
Oversight of a premium audit vendor, in eight checks
- A random re-audit sample every quarter
Scored on Oregon’s significance test: over $500 or 2% of standard premium, whichever is greater, with offsetting errors checked one by one.
- Method by state and premium band
No phone audit where Florida requires mail or physical; field audits where Oregon requires them.
- Standard exception listings on every worksheet
Everyone in 8810, 8742 and 7380 listed with duties, as Oregon’s rules require of insurers.
- Subcontractors matched to certificates by date
With the certificates and invoices returned with the worksheet.
- Signatures and identification where required
Florida requires the auditor and the employer to sign and attach proof of identification.
- Turnaround against your own target
Days from assignment to returned audit, and the share past target by reason.
- Disputes and reversals by vendor
A vendor whose audits are reversed more often is costing goodwill and premium.
- The file comes home
Records, worksheets and notes held by the carrier, retained for regulatory review, with personal data kept out of what goes to the insured.
Classification consistency is the check most worth automating. A carrier that sees, across its book, which class moves its auditors accept, staff or vendor, can spot an auditor who never moves anyone out of 8810 and one who moves everyone. In the fictional sample book, the solution lists every accepted move by kind with its count and premium effect, so a manager can compare auditors and vendors on the same page. The method for building a fair re-audit or seeded test is in premium audit standards.
The audit book in Premium Audit Automation: which class moves auditors accepted
Who is responsible for vendor audit errors?
The insurer, to the regulator and to the insured. The vendor may owe the carrier under their contract, but the insured's bill, the statistical data and the examiner's findings all carry the carrier's name. New York's financial regulator stated the general principle when it addressed outside vendors of AI and data used in underwriting and pricing: it expects "that insurers conduct appropriate oversight over third-party vendors", and it holds the insurer, not the vendor, answerable for the results. The same logic runs through every audit rule quoted on this page.
Write the contract accordingly. It should require the vendor to follow the carrier's audit procedures and each state's rules, return the full file, correct errors found in re-audits or test audits at its own cost, support the carrier in disputes and hearings, and meet turnaround targets. And it should give the carrier the right to re-audit and to see the vendor's quality data.
Can premium audit vendors do virtual audits?
Yes, where the state's rules allow the method for that policy. Oregon distinguishes field audits at the insured's premises or an agreed site, desk audits elsewhere, and payroll reports, and requires annual field audits at $10,000 or more of annual standard premium. Florida requires physical audits on voluntary-market policies of $10,000 or more and on new construction policies, allows mail audits only where a physical audit is not required, and rules out telephone audits in their place (Florida's audit rules). A vendor's remote audit is only as compliant as the method rules the carrier gives it.
Remote work also moves the signature problem. Florida requires the auditor and the employer to sign and attach proof of identification, and its rule allows electronic signatures within the state's electronic signature law. A carrier using vendors for remote audits should specify how identity is verified, and keep the evidence.
How do you compare premium audit companies?
On your own audits, scored the same way. Send each candidate the same set of recently closed audits, or a sample of live ones, and compare the results line by line with a re-audit by your senior auditors, using the same tolerance for premium and the same checks for classes, subcontractors and overtime. Then compare the measures that matter after the audit: turnaround, disputes and reversals, the clarity of the explanation to the insured and the completeness of the file.
Vendor, in-house desk or agents: three ways to staff the audit
The choice is not either-or. Most of the trade-offs below are about where judgement sits and where the file lives, and a carrier can mix the three: its own auditors for the classes and insureds it cares most about, a vendor for distant site visits, and agents to do the chasing, reconciling and drafting for whoever signs.
Three ways to staff the premium audit, compared on what regulators and insureds see
| In-house auditors | Audit vendor | In-house auditors with agents | |
|---|---|---|---|
| Capacity at the expiration peak | Fixed headcount; backlog grows. | Flexes with the vendor’s pool. | Agents chase and draft; auditors decide. Physical visits still need people. |
| Physical and field audits | Travel from the carrier’s offices. | Local auditors where the vendor has them. | Same as in-house; the agents prepare the file before the visit. |
| Consistency of class decisions | One team, one manager. | Many auditors; needs re-audit to hold the line. | Every move logged with its evidence; the book shows accepted moves by kind. |
| The file an examiner sees | Carrier’s own. | Vendor’s worksheet unless the contract brings the file home. | Every figure cited to its record, on the carrier’s file. |
| Explanation to the insured | As good as the auditor’s write-up. | Depends on the handoff to the carrier. | A drafted letter with one plain line per change. |
| Where it does not fit | Peaks and distant insureds. | Tight control of classification and insured experience. | Audits that need a site visit nobody can replace. |
Premium Audit Automation does not replace a vendor's field auditors where a state requires a physical visit, and it does not make outsourcing unnecessary for a carrier without the people to decide and sign. What it changes is where the audit lives: the records, the reconciliation, the classification evidence and the draft sit on the carrier's file, and the auditor's decisions and signature are recorded there. In the fictional sample, an audit above $25,000 of additional or return premium cannot reach billing without the audit manager's second signature, whoever did the work. How the auditor's own role looks inside the solution is set out in what a premium auditor does.
On the carrier's file in Premium Audit Automation: the auditor signs, the manager co-signs
Questions people ask
What does a premium audit vendor cost?
No regulator or research source publishes vendor prices, and vendors set their own terms. Compare the full cost per completed audit: the vendor's fee, plus your own staff's time to assign, re-audit, rate, bill and handle disputes, plus the premium effect of errors found in your re-audit sample.
How fast do premium audit vendors complete audits?
There is no published standard. The Casualty Actuarial Society's ratemaking text puts final workers' compensation premium about three to six months after expiration, and the NAIC expects each carrier to set and meet its own time frame. Put your target in the vendor contract and measure days from assignment to returned audit.
Does a vendor auditor sign the audit in Florida?
The auditor who performs the audit signs. Florida's statute requires the employer or officer and the auditor to print and sign their names on the audit document and attach proof of identification, and its rule prescribes an Auditor's Statement. The carrier remains responsible for the premium that results.
Can the state test-audit a vendor's work?
It test-audits the insurer's book, which includes the vendor's audits. Oregon's rating organization draws its quarterly sample at random from each insurer's entire workers' compensation book, and the results count against the insurer, whoever performed the original audit.
Should insurance agents get audit documents from the vendor?
From the carrier, with the insured's consent. Delaware's 2026 bulletin says "The Department expects carriers to treat agent requests with the same urgency and transparency afforded to insureds", within a process where the insured designates who may see its audit material and its refusal prevails.