Automobile Insurance Market Conduct Assessment Report

Automobile Insurance Market Conduct Assessment Report

Part 1: Statutory Accident Benefits Schedule Part 2: Rating and Underwriting Process

Phase 4 2015

Financial Services Commission of Ontario Market Regulation Branch

P a g e 1

Automobile Insurance Market Conduct Assessment Report, Part 1: SABS, Part 2: RUP; Phase 4, 2015

Table of contents

Executive summary ....................................................................................................................................... 2

1. Background ....................................................................................................................................... 3

2. FSCO’S review ................................................................................................................................... 3

3. Risk rating levels ................................................................................................................................ 4

Part 1 – Statutory accident benefits schedule (SABS) .................................................................................. 7

4. Scope of SABS review ........................................................................................................................ 7

5. Summary of findings ......................................................................................................................... 7

6. Observations about SABS compliance ............................................................................................ 13

Part 2 – Rating and underwriting process (RUP) ........................................................................................ 14

7. Scope of RUP reveiw ....................................................................................................................... 14

8. Summary of observations ............................................................................................................... 15

9. Observations about RUP compliance.............................................................................................. 20

General conclusions .................................................................................................................................... 21

P a g e 2


Executive summary

The Financial Services Commission of Ontario (FSCO) is a regulatory agency established under the Financial Services Commission of Ontario Act, 1997, and is accountable to the Minister of Finance. FSCO regulates the insurance sector; pension plans; loan and trust companies; credit unions and caisses populaires; the mortgage brokering sector; co-operative corporations in Ontario; and service providers who invoice auto insurers for statutory accident benefits claims.

With regards to the auto insurance sector, FSCO works to ensure insurance companies treat claimants fairly and comply with the Statutory Accident Benefits Schedule (SABS), a regulation under the Insurance Act. FSCO also evaluates the market conduct of auto insurance companies in Ontario relating to their rating and underwriting process (RUP), in order to ensure consumers are charged rates that have been approved by FSCO.

In 2012, FSCO began a four-year review of Ontario’s private passenger automobile (PPA) insurance market, distributing a conduct assessment questionnaire each year, from 2012 through 2015. In total, FSCO examined 113 insurers – 34 in Phase One, 42 in Phase Two, 23 in Phase Three, and 14 in Phase Four. This examination reached approximately 100 per cent market share by way of direct written premium.

For Phase Four (in 2015), FSCO sent the questionnaire to 14 PPA insurers, which represented the remainder of the market share (companies with two per cent of the market share by way of direct written premium).

The questionnaire assessed the companies’ risk of non-compliance with regulatory requirements, using a rating scale that ranged from low risk to high risk (risk categories are defined on page 4 of this report). The questionnaire contained two sections: Part A: SABS, and Part B: RUP.

Key findings and recommendations from Phase Four are provided in this report, and are also compared with the findings from the previous three phases.

Any companies with a medium-high to high risk rating were required to submit a plan of action to correct any deficiencies. Those plans of action were received by FSCO and were found to be satisfactory.

For Phase Four, FSCO is satisfied that most companies have sufficient policies and procedures in place over their SABS, and rating and underwriting operations to ensure compliance with regulatory requirements. However, as identified in this report, insurers need to enhance their governance practices and processes to address identified risks, particularly within the following governance areas where FSCO found elevated risk:

• SABS section: anti-fraud measures and management; other controls; management monitoring and reporting; and outsourcing.

• RUP section: rate change and implementation controls; independent review; identification and process over rating errors; and other controls, management monitoring and reporting.

P a g e 3


All companies should be able to use the approach outlined in this report to identify gaps or deficiencies in their SABS claims handling operations and rating and underwriting processes, and develop improvements to reduce the risk of non-compliance.

1. Background

The four-year project required all respondents to complete a detailed questionnaire and file annual attestations regarding the effectiveness of their SABS, RUPs, and internal controls. FSCO modified the questionnaire each year to address emergent issues, and conducted both targeted and random examinations in order to validate insurer responses to the questionnaire.

2. FSCO’S review

In FSCO’s four-year review, each of the four phases had three stages.

Stage One: attestation

All insurers were required to attest that over the past year, they had effective internal controls to combat fraud, and to ensure they were charging and applying the rates and underwriting rules that were filed with and approved by FSCO.

The attestation needed to be signed by the president, chief executive officer, or most senior officer responsible for the insurer’s operations.

Stage Two: questionnaire

Each insurer was required to complete a questionnaire that enabled FSCO to assess the insurers’ processes, procedures and controls. In a minority of cases, companies received a questionnaire twice if FSCO required more data due to a business change or identified a particular risk. The questionnaire was updated each year to reflect emerging trends, allow stakeholders to provide input, and include relevant legislative changes.

For Phase Four, FSCO required all insurers to return the completed questionnaire electronically by July 27, 2015.

P a g e 4


*Phase 4 companies represent 1.46 per cent of the Ontario PPA marketplace; percentage rounded up to two per cent in order to provide whole number for percentage purposes.

Questionnaire completion

Note: The number of companies shown reflects that those with group filings only submitted one questionnaire for the entire group.

Stage Three: risk assessments

FSCO conducted reviews of all completed questionnaires and assigned risk ratings to each key governance area to arrive at an overall risk rating for each company.

FSCO used the results of the overall risk rating to identify companies that were considered medium and high risk. Those companies received a summary of the findings and corresponding recommendations, and were asked to provide action plans based on those recommendations.

3. Risk rating levels

A company’s risk of non-compliance with the requirements ranged from low risk to high risk and was defined as follows:

Risk level Risk rating definition/criteria

High risk The policies and procedures are inadequate and there are potential issues with statutory compliance.

Medium-high risk The written policies are adequate, the monitoring is inadequate and/or key procedures are not sufficiently documented.

Medium-low risk The written policies are adequate, the monitoring is fairly adequate and not all key procedures are documented.

Low risk There are well documented policies and procedures in place, adequate monitoring systems and strong board/senior official oversight.

65%25%

8% 2%

(By company market share %)

Phase 1: 34 companies representing 65%of the Ontario PPA marketplace



Phase 4: 14 companies representing 2%of the Ontario PPA marketplace*

P a g e 5


The preliminary risk rating for the companies in Phase Four, which included nine farm mutual insurance companies, is presented in the following charts. The charts also include a comparison of results by each phase.

Comparison of results by phase – Property and casualty insurers

Phase One risk ratings Phase Two risk ratings

Phase Three risk ratings Phase Four risk ratings

Medium risk- 3

companies (10%)

Low risk- 30 companies

(90%)

(33 total companies - 64.7% marketshare)

Medium risk- 3 companies (10%)

Low risk- 30 companies (90%)

Medium-low risk -21 companies

(78%)

Low risk - 6 companies

(22%)

(27 total companies - 25% marketshare)

Medium-low risk - 21 companies (78%)

Low risk - 6 companies (22%)

Medium-high risk -4 companies (33%)

Medium-low risk - 5 companies

(42%)

Low risk - 3 companies

(25%)

(12 total companies - 8% market share)

Medium-high risk - 4 companies (33%)


Low risk - 3 companies (25%)

High risk - 1 company

(20%)

Medium-high risk - 2 companies

(40%)

Medium-low risk - 2 companies

(40%)

(5 total companies - 0.7% market share)

High risk - 1 company (20%)



P a g e 6


Comparison of results by phase – farm mutual insurance companies

Phase One risk ratings Phase Two risk ratings

Phase Three risk ratings Phase Four risk ratings

Low risk - 1 company (100%)

(1 total company - 0.3% marketshare)

Low risk - 1 company (100%)

High risk - 1 company

(6.7%)

Medium-high risk - 6

companies (40%)

Medium-low risk- 7 companies (46.6%)

Low risk- 1 company

(6.7%)

(15 total companies - less than 0.01% marketshare)

High risk - 1 company (6.7%)



Low risk- 1 company (6.7%)

High risk - 2 companies

(18.2%)


(36.4%)

Medium-low risk -4 companies

(36.4%)

Nil filing - 1 company

(9%)

(11 total companies - less than 0.01% market share)

High risk - 2 companies (18.2%)

Medium-high risk - 4 companies (36.4%)

Medium-low risk - 4 companies (36.4%)

Nil filing - 1 company (9%)

High risk -2

companies (22.2%)


(22.2%)

Medium-low risk- 5 companies

(55.6%)

(9 total companies - less than 0.76% market share)

High risk - 2 companies (22.2%)

Medium-high risk - 2 companies (22.2%)


P a g e 7


Part 1: SABS

4. Scope of SABS review

Consistent with FSCO’s risk-based approach to regulation, the objectives of the SABS review were to:

• determine if FSCO can rely on insurer attestations and questionnaire responses; and • assess if there are acceptable SABS compliance and anti-fraud controls to indicate potential non-

compliance with SABS.

FSCO evaluated each company’s governance over its SABS claims handling through six key areas:

1. Development, documentation and content of SABS claims handling policies and procedures; 2. Fraud management including anti-fraud measures; 3. Existence of other controls, monitoring and management reporting of SABS claims handling; 4. Reliance on any independent review; 5. Outsourcing; and 6. Healthcare service providers.

The higher risk ratings for the SABS section in Phase Four, as compared to the SABS sections in the previous three phases, can be attributed to the smaller size of the insurers examined in Phase Four. Smaller insurers are considered more likely to lack the scale that necessitates numerous formal policies, procedures, processes, and controls as specified in the questionnaire. This is not to say that procedures are not in place. Rather, informal policies and procedures are characteristic of smaller operations with low risk profiles and low volumes of SABS claims.

5. Summary of findings

Development, documentation and content of SABS claims handling policies and procedures

In Phase Four, almost all companies had documented SABS claims handling policies and procedures that were made readily available to all claims-handling staff. Also, the majority of companies had reviewed their policies and procedures for compliance with statutory requirements and Superintendent Guidelines.

The majority of companies had their policies and procedures approved at the senior management level or higher. Some companies also had committees comprised of operational managers, directors and senior executives who developed and approved any changes to policies and procedures.

Furthermore, some companies reviewed and updated their SABS claims-handling policies at stated intervals while taking into account results of complaints, information derived from the claims-handling process, and feedback from employees and claimants. From a documentation perspective, most (approximately 92 per cent) of these companies indicated they document their reviews.

P a g e 8


The majority of companies were found to have policies and procedures in place to:

• address SABS requirements by covering areas such as: o confirming whether claimants have accident benefits coverage; o establishing loss responsibility; o identifying potential fraudulent or suspicious claims; o ensuring appropriate reserves; o providing information and forms to claimants; o establishing payment timelines; and o outlining procedures for a claimant’s appeal process;

• incorporate compliance controls in connection with the adjusting and handling of SABS claims and provisions for the prevention of any Unfair Deceptive Acts or Practices (UDAPs), collectively referred to as “SABS compliance controls”. These controls are established to respect the Minor Injury Guideline (MIG) limits on assessment expenses and insurer examinations. Also, company policies address consistencies with the regulatory requirements for mediation, arbitration and disputes between insurers;

• evaluate claims-handling performance through internal performance benchmarks and standards;

• protect personal information in accordance with Personal Information Protection and Electronic Documents Act requirements;

• require formal staff training, to ensure claims handling in accordance with legislative requirements; and

• handle complaints, including a protocol for complaints escalations and documentation.

Identified risks

FSCO found an increased risk of non-compliance if companies’ claims-handling policies do not explicitly document SABS regulatory compliance controls.

With this in mind, companies examined in Phase Four have been rated as a medium-low risk of non-compliance for policy content and development. This is relatively consistent with the results of the previous three phases, where this section was rated as a low risk and medium-low risk of non-compliance. This indicates that, on an aggregate basis, risks in the marketplace are being mitigated through corporate policies.

Recommendations

In order to ensure compliance with regulatory requirements, FSCO highly recommends that companies document SABS compliance controls within their policies and procedures.

Fraud management including anti-fraud measures

Almost all companies (approximately 92 per cent) in Phase Four indicated having claims-handling policies. These policies included claims cost controls to address fraud and abuse in connection with the adjustment and handling of SABS claims, and SABS compliance controls.

P a g e 9


All companies had fraud identification and escalation procedures, and approximately 77 per cent had established a Special Investigations Unit (SIU) to deal with suspected fraud or suspicious claims.

About 46 per cent of companies identified potential fraudulent or suspicious claims through fraud analysis techniques; only about 38 per cent of those companies also used exceptions reporting.

Overall, about one third of companies said they used automated fraud detection tools or software programs to identify suspicious claims. However, 54 per cent of the companies maintain statistics for potential fraudulent or suspicious claims.

Approximately 85 per cent of respondents indicated they monitor Health Claims for Auto Insurance (HCAI) reports. Almost all (approximately 92 per cent) of these companies also track and monitor the outcomes from potentially fraudulent or suspicious claims files.

Identified risks

In the absence of statistics for identified potential fraudulent or suspicious claims activity, there is an increased risk of fraud or systemic issues not being addressed.

The absence of statistics that track files referred to SIU inclusive of outcomes also causes an increased risk of inaccurate claims assessments or inadequate resources allocated to address potential fraudulent files.

Based on those risks, the anti-fraud measures and management for companies examined in Phase Four have been rated as medium-high risk for the lack of fraud detection tools. This result is similar to Phases Two and Three (rated as medium-high risk) but higher risk than Phase One (rated as low risk). This indicates that, on an aggregate basis, there are increased risks in the marketplace for fraud.

Recommendations

FSCO strongly recommends that companies maintain fraud continuity schedules that track claim files identified as potentially fraudulent or suspicious, and establish a formalized process for reporting potential fraudulent or suspicious claims as a best practice. Specifically, companies should review their escalation procedures to ensure potentially fraudulent claims are handled appropriately and in a timely and consistent manner.

FSCO also recommends that companies explicitly demonstrate when files are referred to the SIU through both automated and manual referral channels. These reports should include files that are accepted or rejected by the SIU.

The reports should also consider potential cost savings identified for open and closed claims files. Furthermore, FSCO highly recommends that company management monitor these reports on a regular basis so they can continue to evaluate what anti-fraud measures work and what do not.

P a g e 10


Existence of other controls, monitoring and management reporting of SABS claims handling

Almost all companies (approximately 92 per cent) in Phase Four had performance benchmarks to evaluate staff efficiency in handling claims. These benchmarks complied with SABS and the Unfair or Deceptive Acts or Practices Regulation requirements at a minimum. Of those companies, approximately 85 per cent gathered statistical information on claims handling for benchmark comparison and had results within their established benchmarks, while the remainder had a few areas that required corrective actions.

All companies indicated having established a process to monitor outstanding and closed SABS claims to ensure they were being adjusted in accordance with statutory requirements. Also, all companies used this process to monitor adjusters’ caseloads, the length of time SABS claims were open, and arbitration and court decisions.

With regards to efficient handling of SABS claims, almost all companies (approximately 92 per cent) had established standards relating to the number of files that can be capably handled by an adjuster, and turnover of staff adjusters. Moreover, 92 per cent had established standards relating to the experience and training required by SABS adjusters.

Approximately 85 per cent of respondents indicated having a process for monitoring the effectiveness of SABS claims handling policies, and making modifications to compliance monitoring systems as a result of new SABS requirements introduced through regulatory changes, the issuance of Superintendent Guidelines, or FSCO bulletins. These companies said they use many of the available tools to assess the quality of SABS claims handling policies such as past results, employee feedback, arbitration decisions and mediation outcomes, consumer complaints, and customer satisfaction surveys.

Approximately 85 per cent of respondents indicated having processes to prepare SABS monitoring reports, communicate results to senior management or higher on an annual or more frequent basis, and take corrective action for non-compliance.

However, FSCO observed that management monitoring and reporting on the impact of the most recent auto reforms was not adequate. In particular, only approximately 46 per cent said they monitor and assess the impact of MIG, and approximately 62 per cent said they monitor the threshold relating to the limit on assessment expenses in their reports. In addition, only 46 per cent said they prepare monitoring reports on disputes between insurers.

Positively, year-over-year, an increasing number of claims are falling within the MIG. From a cost-savings management perspective, approximately 38 per cent said they are monitoring the outcomes from key aspects of the automobile reforms effective September 1, 2010.

Identified risks

There is an increased risk of non-compliance if companies do not monitor and report on compliance with SABS requirements – in particular, timelines, MIG, insurer examinations, disputes between insurers, explanation of claim denials, and assessment expenses.

P a g e 11


In the absence of companies monitoring the key aspects and impact of auto reforms, there is a risk that the resulting benefits from reforms cannot be adequately determined.

Lack of established standards, in terms of experience and training required by SABS adjusters, could lead to inefficiencies as well as inconsistencies in handling SABS claims.

Based on those risks, controls, monitoring and management reporting is rated as a high risk for non-compliance for Phase Four respondents. This result is in line with Phase Three, but higher risk than Phase Two (medium-high risk) and Phase One (low risk). This indicates that insurers with smaller market share have fewer processes in place to monitor and report on compliance with SABS and thus, they have an increased risk of non-compliance, as compared to larger insurers.

Recommendations

FSCO highly recommends that all companies monitor and report on specific SABS compliance requirements – particularly with respect to timelines, MIG, insurer examinations, explanation of claim denials, assessment expenses, and disputes between insurers.

It would be prudent for companies to review their claims classification practices under the MIG to ensure that claims are being handled appropriately.

It is recommended that insurers monitor, document and quantify the outcomes of the key aspects of auto reforms in their management reports.

FSCO also recommends that companies establish standards relating to experience and training required by SABS adjusters. Such standards would support the efficient and consistent handling of SABS claim files.

Reliance on independent reviews

This section details the independent reviews conducted on the claims-handling process, reporting to management and corrective action plans.

Eighty-one per cent of Phase Four respondents indicated they have some form of independent review for their claims-handling process, which is conducted at least once per year. While results varied between companies, the questionnaire revealed that companies used internal auditors, external auditors, external consultants and/or supervisors to perform the reviews.

It was noted that of the companies that performed independent reviews, approximately 85 per cent incorporated SABS compliance controls and cost, and fraud and abuse controls.

Of the companies that performed independent reviews, approximately 85 per cent ensured that results were reported to senior management level or higher. The questionnaire’s results indicated that about 83 per cent of insurers that performed independent reviews had implemented recommendations from the reviews, or had a plan to do so.

P a g e 12


Identified risks

There is an increased risk of non-compliance if independent reviews do not include a review of SABS compliance controls and cost, and fraud and abuse controls. Furthermore, there is an increased risk of non-compliance if independent reviews are not performed annually, at minimum.

Based on those risks, this section has been rated as a medium-low risk for non-compliance. The results for this section in Phase Four are relatively consistent with those of Phases One, Two and Three, where this section was rated as medium-low risk (Phase Two and Three) and low risk (Phase One). This indicates that, on an aggregate basis, independent reviews reduce the risks of non-compliance in the marketplace.

Recommendations

FSCO recommends that the independent review process include a review of SABS compliance controls as well as SABS cost, fraud and abuse controls to ensure companies are compliant with SABS requirements. Further, such reviews should be performed at least annually.

Outsourcing

About 77 per cent of Phase Four respondents said they outsource SABS claims handling or tasks to third parties. Of the companies that outsource, approximately 46 per cent retained full claims file responsibility and ownership, and outsourced on a limited task assignment basis. Examples of specific task assignments include handling employee claims and claims in non-staffed areas where an investigation, initial meeting, statement or information gathering is required.

About 70 per cent of the companies that outsource claims handling or tasks to third parties said they have their outsourced tasks or functions documented in a written agreement or contract. All the companies that outsource said they monitor the performance of the outsourced tasks or functions for compliance with the company’s policies and service-level agreements. However, about 30 per cent of these companies do not monitor outsourced functions with respect to loss and expense costs, as well as fraud initiatives. About 31 per cent of companies do not outsource claims handling even when the work load is in excess of the maximum number of files considered reasonable for adjusters. Outsourcing has been historically categorized as a high-risk function. However, most companies have mitigating controls in place such as documenting outsourced tasks within agreements or contracts and monitoring their performance. Nevertheless, these controls can be solidified by formally documenting and preparing consolidated reports on the quality and outcome of outsourced activities.

Identified risks

In the absence of formal monitoring, consolidation and reporting of outsourced activities, there is an increased risk of non-compliance, negative performance trends or systemic issues not being identified with regards to consistent application of company policies and procedures, and quality standards.

P a g e 13


Based on those risks, outsourcing for Phase Four has been rated as medium-high risk for non-compliance. This is relatively consistent with results in Phase Three, and slightly higher risk than Phases One (medium risk) and Two (medium-low risk). This indicates that insurers with smaller market share have fewer processes in place to monitor and report on outsourcing activities.

Recommendations

FSCO recommends that companies increase the monitoring of outsourced functions with respect to loss and expense costs as well as fraud initiatives.

It is recommended that companies consider all avenues of remedial action if workload capacity issues arise in order to ensure that quality service levels and compliance are not compromised.

FSCO also recommends that companies formally monitor, consolidate, document and report on the performance monitoring results of the outsourced tasks or functions. This will ensure compliance with company policies and consistent performance measurement against company standards.

Healthcare service providers

About 85 per cent of respondents said they have monitoring controls in place for healthcare providers that are not part of their preferred network. Approximately 23 per cent of companies said they did not have controls in place to ensure submissions to HCAI are accurate. About eight per cent of companies said they do not monitor HCAI transactions to identify irregular activities.

Identified risks

FSCO identified a lack of controls for ensuring submissions to HCAI were accurate and monitoring HCAI transactions, which could identify potential fraud. This questionnaire was answered by companies that had as few as 10 SABS claims per year, thus rather than the formal processes alluded to in our questionnaire, monitoring tends to be accomplished through routine file handling.

Based on these risks, the healthcare service providers section has been rated as a low risk of non-compliance. The results for this section in Phase Four are better than those in Phases Two (medium-low) and Three (high risk). This is because smaller insurance companies are less likely to have their own preferred healthcare provider networks, which require formal monitoring.

Recommendations

FSCO recommends that all companies develop and implement controls to ensure submissions to HCAI are accurate. All companies should monitor HCAI transactions to identify irregular activities.

6. Observations about SABS compliance

The overall SABS risk ratings for Phase Four companies (54 per cent of insurers rated low to medium-low risk) were slightly higher than results observed in Phase One (88 per cent rated low risk), Phase Two (96 per cent rated low to medium-low risk) and Phase Three (57 per cent rated low to medium-low risk).The higher risk ratings in Phase Four can be attributed to the smaller size of the insurers examined.

P a g e 14


However, given that the questionnaire through all four phases covered 100 per cent of Ontario PPA market share, the aggregate results indicate that the industry is largely compliant. Although there remains room for improvement in certain areas, FSCO is satisfied that there is an overall medium-low risk of non-compliance in the marketplace.

Based on the aggregate results to date, most companies writing auto insurance business in Ontario continue to have sufficient policies that support sound corporate governance and business practices for SABS claims handling, which mitigate the risk of non-compliance.

The risk-based self-assessment questionnaire on governance for SABS continues to be a useful tool to evaluate the risk of non-compliance and to identify areas for improvement. Conducting on-site examinations to verify processes and policies allows FSCO to validate and confirm questionnaire responses and review higher risk areas, such as:

• monitoring controls; • outsourcing; and, • healthcare service providers.

Combining both methods allows FSCO to obtain a higher level of assurance that auto insurers are in compliance with SABS.

Part 2 – RUP

7. Scope of RUP review

FSCO evaluated company governance for rating and underwriting processes by looking at seven key governance areas:

1. Development, documentation and content of RUP policies and procedures; 2. Rate change process and implementation controls; 3. Manual adjustments of rates and underwriting rules; 4. Reliance on any independent reviews; 5. Identification and handling of rating errors; 6. Intermediaries, monitoring of discrepancies between quoted and issued premiums; and 7. Other controls, monitoring and management reporting of RUP activities.

On an aggregate basis, the questionnaire yielded three high-risk companies and seven medium-high-risk companies, while the remainder were medium-low risk.

FSCO sent a follow-up letter to companies that were rated medium-high and high risk. The letter detailed the significant areas of concern that led to the higher risk ratings, the findings and recommendations. FSCO asked these companies to provide a remedial action plan to address the concerns. FSCO will validate action plans on-site for high-risk areas.

P a g e 15


There was no RUP questionnaire in Phase One. However, Phase Four results indicated an improvement in comparison to both Phase Two and Phase Three results. Given that the questionnaire covered two per cent of Ontario PPA market share in Phase Four and 46 per cent of the companies were rated as medium-high or high risk, there is still room for improving industry compliance and controls to mitigate identified risks.

8. Summary of observations

Development, documentation and content of RUP policies and procedures

All Phase Four respondents indicated having documented policies that govern compliance with regulatory requirements for the use of approved rates, rates and classifications systems (RCS) and underwriting rules. Also, all companies indicated that they review their policies periodically to ensure currency and compliance with regulatory requirements and Superintendent Guidelines.

About 85 per cent of companies have their rating and underwriting policies approved by senior officials or board committee. Further, the majority (about 92 per cent) of companies have their policy reviews and approvals documented. For policies to be amended, approximately 85 per cent of companies made the necessary changes and updated the documentation.

All companies indicated that documented policies are made readily available to all staff who are required to know and apply the policies.

All companies have policies that set out a process to ensure implementation of approved rates, RCS and underwriting rules. However, only 77 per cent of companies have policies that set out a process for reporting errors.

Identified risks

In the absence of a formal process for reporting errors, there is an increased risk of prolonged rating errors or unreported compliance issues, including a lack of early stage notification to FSCO.

There may be an increased risk of non-compliance if policies and procedures are not kept up-to-date and/or there is no management approval documented.

Based on these risks, this “development, documentation and content of RUP policies and procedures” section has been rated as a low risk of non-compliance for rates and underwriting practices. The risk rating in Phase Four is the same as that in Phase Three, which were also rated as low risk, and an improvement over that of Phase Two (medium-low risk). The results indicate that the risks in the marketplace are being addressed through corporate policies. There were no comparable results for this section in Phase One.

Recommendations

As a best practice, companies should have a formal, documented procedure to address and report rating and underwriting errors in a timely manner.

P a g e 16


FSCO also recommends that companies document updates and amendments to their policies and procedures.

Rate change process and implementation controls

With regards to rate changes, all companies in Phase Four indicated that their rate change process includes pre-rate implementation testing. For example, these companies design test cases for specific changes such as new discounts and rating factors before the new rates are implemented. Actual results within the test environment are then compared to the expected results to ensure alignment with the filed (revised) rates and risk classification systems. All the companies also use random sampling of live policies to ensure compliance with filed rates, and rates and classification systems. However, only half (54 per cent) said they include the pricing actuary’s review and approval during the rate-change process.

From a continuous monitoring perspective, approximately 69 per cent of companies said they have a recurring rate verification process that operates independently of a rate change.

About 69 per cent of companies said they used a formalized sampling protocol in their pre-rate implementation testing, and 85 per cent used a formalized sampling protocol in their post-rate implementation testing.

Lastly, only a few companies (approximately 23 per cent) said they conduct testing on renewal rates that are capped.

Identified risks

FSCO identified that recurring rate verification reviews were being done by actuaries when a change was implemented, but were not routinely being implemented on a routine cycle. The same was found to be true for testing on capped renewal rates.

Based on those risks, this “rate change process and implementation controls” section has been rated as medium-low risk of non-compliance for RUP. The results for Phase Four remain the same as Phase Three, which were also rated as medium-low risk. This was an improvement over the results in Phase Two (medium-high risk). This indicates that the risks in the marketplace are being addressed through business processes. There were no comparable results for this section in Phase One.

As a best practice, and to ensure compliance with approved rates, RCS, and underwriting rules, FSCO recommends that companies:

• perform more recurring rate verification procedures that operate independently of a rate change;

• perform testing on renewal rates that are capped; and, • increase the level of review and approval by the actuary as part of the rate-change process.

P a g e 17


Manual adjustments of rates and underwriting rules

FSCO reviewed the manual adjustment process, which includes controls around manual rate adjustments and underwriting rules.

All companies in Phase Four indicated they allow rates for a policy or endorsement to be manually amended or corrected by staff. The companies also indicated that controls are in place to ensure rate adjustments are compliant with applied underwriting rules and with rates approved by FSCO. All companies also said they maintained audit trails for manually-adjusted rates.

Based on those results, this section has been rated as low risk of non-compliance for rates and underwriting practices – an improvement in comparison to the results in Phases Two and Three (both medium-low risk). This finding indicates that risks in the marketplace can be addressed through corporate policies. There were no comparable results for this section in Phase One.

Reliance on any independent reviews

The questionnaire results indicated that almost all (92 per cent) of companies perform internal or external independent audits confirming the verification of approved auto rates. These companies have their independent reviews performed by an internal auditor, external auditor or external consultant.

Non-compliance in this area is of concern to FSCO, as the annual attestation asks the insurer to attest it has implemented and administered audit processes appropriate to its circumstances, to ensure approved or authorized rates are charged.

Of the 92 per cent of companies that perform independent audits on verification of approved auto rates, 85 per cent said they perform the reviews annually. Other companies either do not have an audit process in place or conduct reviews when there is a rate change. Among the companies that perform independent reviews, FSCO noted that about 77 per cent develop and implement action plans for identified issues.

Identified risks

FSCO found that independent rate verification reviews are not conducted on an annual basis or at all. As well, FSCO found that companies do not establish sufficient procedures for creating and implementing corrective action plans and subsequent monitoring.

Based on those risks, this section has been rated as medium-high risk of non-compliance. The results for this section in Phase Four show an improvement from both Phases Two and Three, which had a rating of medium-high risk. There were no comparable results for this section in Phase One.

Recommendations

FSCO strongly recommends that companies institute the FSCO requirement, as outlined on the annual attestation, that insurers have an independent review or audit conducted at least on an annual basis.

P a g e 18


FSCO strongly recommends that the scope of the independent reviews include high-level governance and controls over the RUP, as well as policy sampling, to ensure appropriate application of auto rates.

It is recommended that companies establish appropriate and timely corrective action plans for identified issues. FSCO also recommends that senior officials review reports and be involved in the creation and implementation of corrective action plans, and subsequent monitoring.

Identification and handling of rating errors

All companies indicated they have formalized, documented inquiry management procedures for handling rating or underwriting inquiries or complaints from consumers or intermediaries. These companies also said they use their rating and underwriting inquiry process to identify potential compliance risks or rating errors to promptly remedy any issues of non-compliance.

Moreover, the majority (approximately 85 per cent) said they have procedures that allow for aggregation of inquiries based on the specific type of issue identified during the review (e.g., rating element, specific rule).

Approximately 77 per cent of companies indicated they have a process that includes, as required, notifying FSCO of any rating errors.

Identified risks

In the absence of inquiry aggregation and trending analysis, there is an increased risk of unidentified compliance issues. There is also an increased risk of prolonged rating errors or non-compliance issues if companies do not notify FSCO of all rating errors in a timely manner.

Based on those risks, this section has been rated as medium-low risk of non-compliance for rating and underwriting practices. Only a few companies said they do not monitor trends to identify potential compliance risks and have no process in place to notify FSCO of rating errors, as is required.

The results show an improvement from Phases Two and Three, which were rated as medium-high risk. Overall, the risks in the marketplace are being thoroughly addressed through business processes. There were no comparable results for this section in Phase One.

Recommendations

FSCO recommends that companies aggregate and trend inquiries to allow for prompt identification and remedy of any non-compliance issues.

FSCO highly recommends that companies have a formalized, documented procedure to notify FSCO of any rating errors in a timely manner.

P a g e 19


Intermediaries, monitoring of discrepancies between quoted and issued premiums

About 77 per cent of companies indicated they use intermediaries who have the authority to issue auto policies or endorsements. These companies use different types of intermediaries such as brokers, agents and call centres.

Some companies (approximately 60 per cent) said they monitor discrepancies between quoted and issued premiums and/or have controls in place to ensure that the consumer is receiving the rate initially quoted.

Identified risks

Monitoring discrepancies between quoted and issued premiums and/or having controls in place is necessary to ensure that consumers are receiving the rates initially quoted. A lack of controls increases the risk of not detecting rating errors.

Based on those risks, this section has been rated as a medium-low risk of non-compliance for rating and underwriting practices. The results for this section in Phase Four are consistent with results in Phases Two and Three where this section was also rated as medium-low risk. Results indicate that the risks are being addressed through business processes. There were no comparable results for this section in Phase One.

Recommendations

As a best practice, FSCO recommends that companies monitor discrepancies between quoted and issued premiums and/or have controls in place to ensure that the consumer is receiving the rate which was initially quoted.

Other controls, monitoring and management reporting of RUP activities

Almost all insurers (approximately 92 per cent) indicated having a monitoring process in place to ensure adherence to company compliance practices, procedures and protocols. Furthermore, these companies indicated that a senior employee or board committee has the operational responsibility for monitoring compliance with rating and underwriting rules requirements.

Some companies (approximately 62 per cent) prepare compliance reports to monitor and assess risks at a rating or underwriting level. Most of these compliance reports are reviewed by senior officials or a board committee. All of the companies that prepare compliance reports indicated they also have a process in place for corrective action on identified issues or deficiencies with the policies or statutory requirements.

Only 38 per cent of companies have a process in place for decommissioning security access to FSCO’s ARCTICS system when a company designate with access is no longer employed.

Lastly, 62 per cent said they do not have a policy that ensures the prohibition of credit history and credit rating factors in the rating or underwriting of auto insurance.

P a g e 20


Identified risks

FSCO found a lack of compliance reports generated annually (at a minimum) by supervisors, risk management, and the chief compliance officer, to assess potential risks. There was also a lack of processes in place to decommission security access to FSCO’s ARCTICS. FSCO noted the insufficiency of policies that prohibit the use of credit history and credit rating factors in the rating or underwriting of auto insurance.

The results for this section in Phase Four are consistent with results in Phase Three where this section was also rated as medium-high risk. There were no comparable results for this section in Phases One and Two.

Recommendations

Companies should generate compliance reports annually at a minimum. These reports should be created by supervisors, risk management, and the chief compliance officer to assess potential risks. These reports should also prioritize compliance risks based on the magnitude of the issue.

FSCO reminds companies that using credit information as a factor for rating or underwriting auto insurance is prohibited under the Insurance Act. It is essential that policies be in place to ensure credit information is not used.

9. Observations about RUP compliance

The overall RUP risk ratings for Phase Four were better in comparison to results observed in Phase Three.

There is an improvement in risk ratings from Phases Two and Three to Phase Four within seven key governance areas. The comparative results indicate that compliance with rating and underwriting practices is improving and that controls have been strengthened to mitigate identified risks.

In general, there remains room for improvement to bring the industry into compliance and to implement controls to mitigate identified risks.

P a g e 21


RUP Compliance risk rating

General conclusions

Most companies writing auto insurance business in Ontario continue to have sufficient policies to ensure sound corporate governance and business practices for rating and underwriting activities.

The risk-based, self-assessment questionnaire on the governance of rating and underwriting processes is a useful tool to evaluate the risk of non-compliance and to identify areas for improvement.

The combination of on-site examinations with the questionnaire also allows FSCO to gain a higher level of assurance that automobile insurers conduct rating and underwriting activity in compliance with regulatory requirements. FSCO encourages the boards of directors and senior management of insurance companies to benchmark their companies against the aggregate results in this report and to implement the recommendations in each of the governance areas. This would allow insurers to evaluate their own risk of non-compliance and to identify areas for improvement.

FSCO is satisfied that most companies have sufficient policies and procedures in place over their SABS, and rating and underwriting operations to ensure compliance with regulatory requirements.

However, as identified in this report, insurers need to enhance their governance practices and processes to address identified risks, particularly in these areas:

• SABS: anti-fraud measures and management; other controls, management monitoring and reporting and outsourcing.

• RUP: rate change and implementation controls; independent review; identification and process over rating errors; and other controls, management monitoring and reporting.

All companies are encouraged to use this approach to identify gaps or deficiencies in their SABS claims handling operations and rating and underwriting processes, and develop improvements to reduce the risk of non-compliance.

78% of insurers with low and medium-low risk

ratings

83% of insurers with low and medium-low

risk ratings

54% of insurers with low and medium-low

risk ratings

25%

8%2%

Phase 2 Phase 3 Phase 4

Insurers' risk ratings (%) Ontario PPA Marketshare (%)