A corporate buys insurance to transfer risk. But between the moment a policy is purchased and the moment a claim is made, something often goes quietly wrong: the business grows, assets appreciate, new risks emerge, a key exclusion is missed at renewal, and the sum insured drifts away from reality. When the claim finally arrives, the payout falls materially short of the loss — not because the insurer acted in bad faith, but because the policy no longer reflected the risk it was meant to cover.
This is the problem a corporate insurance audit is designed to prevent. It is not an audit of an insurance company — it is an independent, structured review of the corporate buyer's insurance programme: the policies held, the risks faced, and the gap between them.
What a Corporate Insurance Audit Is — and Is Not
The term "insurance audit" is used in two completely different contexts in India, and the distinction matters:
| Context | What it means | Who does it |
|---|---|---|
| Audit of an insurance company | Statutory financial audit, actuarial reserving review, IRDAI compliance — examining the insurer's accounts | Statutory auditor, appointed actuary |
| Corporate insurance audit (this article) | Independent review of a corporate's own insurance portfolio against its risk profile — examining the buyer's cover adequacy | Risk manager, independent insurance adviser, actuary |
The corporate insurance audit is a buy-side exercise. The corporate is the client; the insurer's adequacy is not in question. What is being tested is whether the corporate's insurance programme — the collection of policies it has purchased — adequately covers the risks it actually faces.
Why Most Indian Corporates Need One
Several structural features of how insurance is bought in India create systematic gaps:
1. Policies are renewed, not redesigned
The majority of corporate insurance in India is renewed annually with minimal review. The broker sends a renewal notice; the finance team approves the premium; the policy continues on the same terms as the prior year — sometimes for a decade. Meanwhile, the business has grown, added facilities, entered new markets, changed its liability profile, and taken on new contractual obligations. The policy has not kept pace.
2. Sum insured stagnation
Property, plant, and equipment values change with inflation and capital expenditure. A factory valued at ₹50 crore in 2015 may cost ₹90 crore to replace in 2026 — but the fire policy may still show a sum insured of ₹55 crore, last updated in 2018. This is underinsurance, and it has direct legal consequences under the average clause.
3. The expectation vs. reality gap
This is the most insidious form of coverage gap. A company's board believes it is covered for a specific risk. Its insurance certificate says it holds a policy of that type. But the actual policy wording contains exclusions, sub-limits, or conditions that mean the specific loss event the board imagined is not, in fact, covered. Common examples in India:
- A company holds a Directors & Officers (D&O) policy but the policy excludes claims by regulators — the most common source of D&O claims in India
- A manufacturing company holds a product liability policy but the policy excludes recall costs — the most expensive component of a product liability event
- A logistics company holds a cargo policy that excludes unexplained shortage — the most common cargo claim
- A company holds a business interruption (BI) policy but the indemnity period is 3 months — while its actual recovery time for a major loss is 18 months
4. New risks with no corresponding cover
Risk profiles evolve faster than insurance programmes. Cyber risk is the clearest example: most Indian corporates adopted digital infrastructure aggressively through 2020–2024, but cyber insurance penetration among Indian companies remains below 15% as of 2026. Similarly, companies that have expanded into international markets may have liability exposures in foreign jurisdictions that are entirely uncovered under their India-only policies.
The Eight Categories an Insurance Audit Examines
The Role of Actuarial Analysis in an Insurance Audit
An insurance broker can identify policy gaps through document review. An actuary adds a quantitative dimension that changes the nature of the exercise from qualitative identification to risk-based prioritisation and capital allocation.
Quantifying the uninsured exposure
For each identified gap, the actuary estimates the probable maximum loss (PML) — the realistic worst-case financial exposure the company faces from that uninsured or underinsured risk. This transforms the gap from a narrative concern into a number that the CFO and board can evaluate: "Our business interruption gap exposes us to a potential uninsured loss of ₹35–45 crore over an 18-month recovery period." That number then drives a rational decision — purchase an extended indemnity period policy, self-insure through a captive reserve, or accept the risk.
Risk ranking and capital allocation
Not every gap is equally important. The actuary constructs a prioritised risk matrix — scoring each gap on severity (the financial magnitude of the uninsured loss if it occurs) and frequency (the probability of it occurring in any given year). This produces a rational ordering of corrective actions and allows the insurance budget to be allocated to the highest-impact gaps first.
Corrective action options
Once gaps are identified and quantified, the corrective response is not always "buy more insurance." The actuary and risk manager together consider four options for each identified gap:
- Purchase additional or extended cover — the most straightforward response; appropriate where the PML is large and the premium is proportionate
- Increase the sum insured — for underinsurance in existing policies; removes the average clause exposure without changing the policy structure
- Self-insurance / captive reserve — where the risk is too frequent, too specific, or too unusual for the commercial market to price efficiently; the company maintains an internal reserve funded by the premium it would have paid
- Risk mitigation — address the root cause rather than the financial consequence; sprinkler installation, cybersecurity controls, supplier diversification. Mitigation reduces both the probability of loss and the insurance premium.
The Audit Process — Four Phases
Risk inventory and policy collection
Compile all current policies with schedules, wordings, endorsements, and renewal terms. Map the organisational structure — all entities, locations, and operations covered. Identify all contractual insurance obligations (from customer contracts, lease agreements, lender covenants). This phase establishes the baseline: what is held.
Risk exposure assessment
Document all material risks faced by the business — property values at all locations (current reinstatement basis), revenue and gross profit figures for BI calculation, headcount and payroll for employer liability limits, contractual liability obligations, data volumes and cyber infrastructure, product liability profile. This establishes what the policies should cover.
Gap analysis and PML quantification
Compare the exposure map against the policy portfolio. For each identified gap — missing cover, inadequate sum insured, problematic exclusion, insufficient indemnity period — quantify the probable maximum loss. Rank by severity and frequency to produce the prioritised gap register.
Corrective action plan and implementation
For each priority gap, specify the corrective action: policy endorsement, sum insured revision, new policy placement, self-insurance reserve, or risk mitigation. Produce a cost estimate for each remediation. Present to the CFO and board with a phased implementation timeline, prioritised by risk severity. Track implementation through to the next renewal cycle.
When Should a Corporate Commission an Insurance Audit?
In our view, every three years. Additionally, an audit or at minimum a targeted coverage review is warranted at:
- Acquisition or merger — the acquired entity's risk profile, policies, and claims history must be assessed and integrated
- New facility, plant, or warehouse — new assets create new fire, liability, and BI exposures not in the existing programme
- Entry into a new market or geography — international operations, new product lines, or new customer segments change the liability profile
- Major capex — significant equipment purchases or construction projects require temporary works cover and post-completion sum insured updates
- Significant headcount change — particularly in employee benefits covers, where sum insured adequacy and network coverage are headcount-sensitive
- After a claim — a loss event reveals which covers performed as expected and which did not; the post-claim audit is the most instructive of all
- Change in lender or listing status — banks and institutional lenders often have insurance covenant requirements that require verification; pre-IPO companies face enhanced D&O and professional indemnity needs
What the Audit Does Not Do
A corporate insurance audit does not select insurers, negotiate premiums, or place policies — those are broker functions. The audit is an independent advisory exercise: it tells the company what it should have, quantifies what it currently lacks, and recommends corrective action. Implementation is then executed through the company's broker and insurance relationships. The independence of the audit from placement is what gives its findings credibility with the board and lenders.
Key Takeaways
- A corporate insurance audit reviews the buyer's coverage adequacy — it is entirely distinct from auditing an insurance company's financials
- The average clause means underinsurance affects partial claims, not just total losses — a 40% underinsurance gap costs 40% of every claim
- Business interruption indemnity periods are consistently too short; recovery timelines of 18–36 months are common but 3–6 month policies are standard
- Cyber risk is the largest uninsured exposure for most Indian corporates and is explicitly excluded from standard commercial policies
- Actuarial analysis quantifies the probable maximum loss for each gap, enabling rational prioritisation and capital allocation rather than intuition-based decisions
- Corrective action is not always "buy insurance" — self-insurance reserves, risk mitigation, and policy restructuring are often more efficient responses to specific gaps
- Conduct a full audit every three years and at every material business event — M&A, new facility, new market, major capex
Is your insurance programme keeping pace with your business?
Kapadia & Kochrekar provides independent insurance audit services for corporates — combining policy analysis with actuarial quantification of uninsured exposures. We produce a prioritised gap register with probable maximum loss estimates for each identified risk, and a corrective action plan with cost-benefit analysis. Our work is independent of insurance placement — we have no interest in which insurer or policy you choose, only in ensuring your programme accurately reflects your risk.
Commission an Insurance Audit arrow_forward