View source for Definition:Segregation of duties

🔐 '''Segregation of duties''' is an [[Definition:Internal control | internal control]] principle that requires different individuals or teams to handle distinct stages of a business process — such as [[Definition:Underwriting | underwriting]], [[Definition:Claims | claims]] authorization, and payment disbursement — so that no single person can initiate, approve, and complete a transaction without independent oversight. In the insurance industry, where high-value [[Definition:Premium | premium]] flows, [[Definition:Claims settlement | claims payments]], and [[Definition:Investment portfolio | investment transactions]] create ample opportunity for [[Definition:Fraud | fraud]] or error, segregation of duties is a cornerstone of the governance frameworks demanded by [[Definition:Regulatory authority | regulators]], [[Definition:Rating agency | rating agencies]], and [[Definition:External auditor | external auditors]].

⚙️ A well-designed control environment separates key functions across the insurance value chain. In [[Definition:Claims | claims]] operations, one person investigates and recommends a settlement amount while a different authority approves the payment, and a third party reconciles the disbursement against the [[Definition:Claims reserve | claims reserve]]. In [[Definition:Underwriting | underwriting]], the person who prices a risk should not also be the one who binds [[Definition:Coverage | coverage]] and issues the [[Definition:Insurance policy | policy]] without a peer review or managerial sign-off. Finance departments enforce similar splits between the staff who record [[Definition:Premium | premium]] receipts, those who authorize [[Definition:Reinsurance | reinsurance]] recoverables, and those who perform bank reconciliations. Technology platforms — including modern [[Definition:Policy administration system | policy administration systems]] and [[Definition:Enterprise resource planning (ERP) | ERP]] solutions — enforce these separations through role-based access controls that physically prevent a user from performing incompatible functions.

📋 Regulators such as the [[Definition:National Association of Insurance Commissioners (NAIC) | NAIC]] embed segregation of duties expectations within their [[Definition:Model Audit Rule | Model Audit Rule]] and [[Definition:Risk-based capital (RBC) | risk-based capital]] examination guidelines, and [[Definition:Sarbanes-Oxley Act | Sarbanes-Oxley]] requirements amplify them for publicly traded [[Definition:Insurance holding company | insurance holding companies]]. When [[Definition:Managing general agent (MGA) | MGAs]] or [[Definition:Third-party administrator (TPA) | third-party administrators]] handle [[Definition:Delegated underwriting authority (DUA) | delegated authority]] on behalf of [[Definition:Insurance carrier | carriers]], the principle extends across organizational boundaries — the carrier must verify that its delegate maintains adequate segregation within its own operations. Breakdowns in segregation have been at the root of some of the industry's most damaging fraud cases, making it not merely an audit checkbox but a fundamental safeguard of [[Definition:Policyholder | policyholder]] assets and market confidence.

'''Related concepts:'''
{{Div col|colwidth=20em}}
* [[Definition:Internal control]]
* [[Definition:Model Audit Rule]]
* [[Definition:Sarbanes-Oxley Act]]
* [[Definition:Enterprise risk management (ERM)]]
* [[Definition:Third-party administrator (TPA)]]
* [[Definition:Delegated underwriting authority (DUA)]]
{{Div col end}}