Insurer Life Code Breach – Delayed Underwriting Decisions

A breach of the Life Insurance Code of Practice around delayed underwriting decisions emphasises the need for life companies to be vigilant in monitoring their systems, promptly identifying and rectifying issues and continually improving their compliance frameworks, says the Life Code Compliance Committee.

In a Notice of Determination the committee outlined its findings into a “significant breach” of the code reported by an unnamed life insurance company, which subscribes to the code.

The LCCC says the company reported a significant breach of section 5.4 of the Code in November 2022, around delayed underwriting decisions for  consumers. This section stipulates that subscribers must inform consumers of their life insurance application decisions within five business days, provided all required information has been received.

 The committee’s determination says the significant breach involved Death, Terminal Illness, TPD and IP policies owned by a superannuation fund trustee.

The breach was brought to the subscriber’s attention by the fund in October 2021, following a delayed underwriting decision for a consumer.

…the issue was caused by an ‘extra line break/space’ in some underwriting applications within its transfer file…

It says that subsequently, the life company conducted an investigation “…and discovered that the issue was caused by an ‘extra line break/space’ in some underwriting applications within its transfer file to the fund.”

This technical problem prevented underwriting decisions from being transmitted to the fund’s administration system.

“To address the issue, the subscriber implemented a system enhancement in February 2022. However, before this enhancement  63 consumers had already faced delayed underwriting decisions.”

Between January 2021 and February 2022, the fund failed to provide timely underwriting decisions to 126 consumers.

The LCCC assessed the matter “…and confirmed that the reported breach of section 5.4 of the Code was significant, as assessed by the subscriber.”

 The committee says that based on information obtained from the insurer, delays beyond the five business day timeframe were between one day and 219 days, with the average delay being 74 business days.

It notes the incident persisted for over 12 months before the subscriber identified it as a significant breach in November 2022. “Consequently, the Life CCC confirmed the subscriber’s self-reported significant breach of section 5.4 …”

 Remediation

The committee says the life company reported the breach nine months after implementing a system enhancement in February 2022, which successfully rectified the root cause of the line break error.

To address the issue and remediate the situation, the company undertook:

• Collaboration with the fund: It worked closely with the fund to ensure effective communication of underwriting decisions to all impacted consumers.
• Suitable commencement dates: Impacted consumers who had their cover approved were provided with suitable commencement dates that did not put them at a disadvantage should they decide to proceed with the coverage
• Implementation of reconciliation control: The subscriber put in place a reconciliation control mechanism to monitor and identify any discrepancies between the underwriting decisions made from its transfer file and those sent to the fund. As of March 2023… no further anomalies had been identified

“As per the subscriber’s report, there is no indication that the affected consumers suffered any financial loss due to the breach. Overall, the subscriber took appropriate actions in rectifying the issue and implementing measures to prevent similar incidents in the future,” the LCCC states.

 …subscribers must … not solely rely on external parties to alert them…

As to key learnings, the committee points to:

• Unforeseen events can occur: This incident underscores that even with adequate systems in place, unforeseen events can arise. Despite the subscriber’s efforts to maintain a functional system, the line break error still occurred, resulting in delayed underwriting decisions
• Prompt issue identification is crucial: The breach went unnoticed … for a significant period of nine months. The fund brought the issue to the subscriber’s attention. Subscribers must establish processes to promptly identify system issues and not solely rely on external parties to alert them
• Robust compliance framework: The incident highlights the importance of having a robust compliance framework which should include regular monitoring and continuous improvement of systems to prevent future breaches and ensure compliance with industry regulations and codes
• Continuous improvement: Subscribers should not only address immediate issues but also focus on continuous improvement. Regularly reviewing and refining their systems will help mitigate risks and maintain compliance with industry standards

Click here for the full determination.