ServiceNow Audit Management for Insurance

How Insurance Organizations Use Audit Management

Insurance organizations conduct internal audits to assess control effectiveness across underwriting, claims, operations, and compliance. Audit Management in ServiceNow streamlines the entire audit lifecycle: planning audits, defining scope and sampling, executing testing, documenting findings, assigning remediation, and tracking closure. For insurance, Audit Management is also the repository for findings from regulatory examinations (state insurance department audits, federal audits); the internal audit team uses ServiceNow to track what regulators found and what the organization committed to remediate.

Audit Management connects to GRC (Governance, Risk and Compliance) so that findings link to controls, policies, and remediation actions. When an audit finds that underwriting staff are not following the documented underwriting policy, the audit finding links to the control and the policy, enabling leadership to see the full context and orchestrate remediation. This integration ensures that audit findings drive compliance improvements across the organization, not just documentation of problems.

Industry-Specific Processes and Regulations

Insurance audits are not purely internal; they are driven by regulatory requirements. State insurance departments examine insurers regularly, and findings are tracked with formal response requirements. Internal audit functions must align their scope with regulatory examination priorities and must coordinate with Compliance to address regulator findings. Audit Management becomes the central log of what auditors (internal and external) tested, what they found, who is remediating, and what evidence proves closure.

Key stakeholders include Internal Audit (planning and executing audits), Compliance (interpreting regulatory findings), operational leaders (remediating findings), and the Audit Committee (oversight). Audit Management workflows ensure that findings are raised to the Audit Committee or Board level when severity warrants. Insurance regulators increasingly expect organizations to demonstrate that findings from both internal and regulatory audits are tracked systematically and remediated on schedule.

Design Decisions That Differ from Generic Implementations

Standard audit implementations focus on IT controls; insurance implementations span underwriting, claims, and operational processes. Create audit plan templates for each major process (underwriting, claims adjudication, premium collection, fraud investigation). Use custom fields to tag findings by regulatory domain (state insurance code, NAIC model law) and to track whether the finding originated from internal audit or a regulatory examination.

Implement approval workflows so that high-severity findings are escalated to the CFO or Audit Committee. Use dashboards to show audit findings by line of business, control area, and severity, with heat maps showing which processes need the most remediation effort. Create separate workflow tracks for internal findings and regulatory findings, since regulatory findings often have formal deadline requirements and escalation procedures defined by the regulator.

Regulatory Finding Management and Remediation Tracking

When state insurance examiners issue findings or recommendations, they are entered into Audit Management as external audit findings. These are formally tracked, assigned for remediation, and tracked through closure. Regulators often provide a remediation deadline; Audit Management ensures owners stay accountable. Maintain audit evidence (testing results, samples reviewed, policy compliance certifications) in linked documents or Knowledge Management articles so auditors and regulators can easily review your audit trail and evidence of compliance.

Use custom fields to track the regulatory reference (which state regulation, NAIC model law, or examination item corresponds to each finding), the regulator’s required remediation date, and proof of remediation. Some regulators require written proof of remediation; Audit Management can store remediation evidence and generate reports for regulator submission. Establish a formal process: when a regulator issues findings, they are logged within days; when remediation is complete, supporting evidence is documented; when evidence is submitted to the regulator, this is recorded in ServiceNow. This creates an auditable trail of your compliance response.

Common Pitfalls and Mitigations

Insurance organizations often have loose separation between internal audit and Compliance. Define clear roles in Audit Management so Internal Audit owns the audit process and findings documentation, while Compliance owns the regulatory relationship and provides input on scope. Another pitfall is not tracking remediation follow-up; findings are documented but remediation is never validated. Implement a testing phase in Audit Management where you re-test remediated controls to confirm effectiveness.

A third mistake is not surfacing critical findings to leadership quickly; use escalation workflows to alert the Audit Committee when findings are high-severity. A fourth pitfall is inadequate evidence retention; regulators may request documentation years later to verify that remediation actually occurred. Establish document retention policies and link evidence documents to audit findings so regulators can request proof of your compliance response. Train audit staff to document findings precisely: what control was tested, what sample was tested, what was found, and what evidence proves remediation worked.

Quick Checklist for Insurance Audit Design

• Create audit plan templates for key processes (underwriting, claims, operations).
• Track findings origin: internal audit vs. regulatory examination, with regulatory reference if applicable.
• Link findings to control objectives and policies for full context and compliance visibility.
• Implement escalation workflows for high-severity findings to the Audit Committee or Board.
• Assign remediation to operational owners with realistic deadlines aligned to regulatory timelines.
• Document testing evidence (samples tested, results, certifications) linked to audit findings.
• Implement follow-up testing to validate remediation effectiveness before closure.
• Create separate workflows for regulatory vs. internal findings, tracking regulator deadlines and submission evidence.

Planning an internal audit engagement around the evidence an examiner will ask for

An internal audit lead at an insurer often learns about the evidence problem during the examination, not before it. The examiner asks for the records behind a sample of decisions, the team produces a folder of screenshots and approval emails, and the gap between what happened and what can be shown becomes the finding. Audit management in a workflow platform exists to close that gap by planning each engagement around the records that will be sampled, not around the process map that the auditor will read first. The reader here is the audit lead who wants engagements that hold up when examined.

Start with the question the engagement answers. A review of claims settlement authority asks whether approvals were given by people with the right delegated limit at the time of approval. A review of complaint handling asks whether each complaint received a timely acknowledgement and a documented outcome. The two engagements need different samples, different fields and different evidence, and an engagement that tries to cover both will sample neither well. Write the question first, then list the records that answer it.

Matching the engagement to the records it will sample

Sequencing an engagement from scope to closure

1. Write the engagement question and the period it covers. Agree the population definition with the process owner before any sampling starts, because a disputed population invalidates the result.
2. Pull the population from the workflow records rather than from a report prepared for management. Management reports are useful context but they are not the population.
3. Choose the sample method, and record why it suits the risk. Where a population contains high-value or unusual items, test those completely rather than sampling them.
4. Test each sampled item against the evidence fields, and record the result against the item, not in a separate summary document.
5. Raise findings with the root cause stated, the control owner named and a remediation date agreed. A finding that describes the symptom without the cause can recur.
6. Close the engagement only after management’s remediation is tested. Re-testing is part of the engagement, not an optional follow-up.

The failure modes that surface during examinations

The first failure is an evidence trail that exists but cannot be attributed. An approval recorded as a shared login, or an override applied by an administrator without a reason field, tells the examiner that a control existed without showing that it operated. Where the platform allows it, require the reason and the named approver as mandatory fields rather than recommended ones.

The second failure is findings that never close. An audit program that raises findings faster than they are remediated produces a list that management stops reading. Track the age of open findings and report it to the audit committee in the same format each time, so the trend is visible.

The third failure is confusion between the audit function and the control owner. When the same person designs a control and tests it, the test loses value. The platform should record who performed each step, so the independence of the testing can be shown when asked.

Telling whether the audit program is worth its cost

Check whether the findings from one year lead to changes in the control environment the next year. If the same types of finding recur across engagements, the program is identifying problems without changing the conditions that produce them. Another useful check is whether the engagement population matches the population the business actually processes. An audit that samples a clean subset of records can report clean results.

When the audit module is the wrong place for a question

Not every concern needs an engagement. A single unexplained payment, a complaint that a manager wants reviewed informally, or a process question from a new hire should go to the owning team or to a control review that is lighter than a full audit. Using the audit module for everything inflates the findings list and makes the serious ones harder to see. Keep a clear threshold for when a question becomes an engagement, and write it into the audit charter.

Questions audit leads ask about the first cycle

Should the population include records that were later reversed?

Yes. A reversed approval or a withdrawn complaint still carries evidence about the control’s operation at the time. Exclude reversals only if the engagement question concerns the final state rather than the process.

How do we handle records that predate the platform?

Test them separately and state the source limitation in the engagement report. Pre-platform evidence is valid, but mixing it with platform records without disclosure overstates the completeness of the audit trail.

Who should receive a finding first?

The control owner, in a private conversation, before the formal report. Surprising a manager with a finding in a committee pack can damage the remediation discussion and does not usually improve the fix.

Can management close a finding by describing a fix?

No. A closure needs evidence that the fix operates, which means the audit team re-tests it on a fresh sample. Describing the fix is the start of the closure process.

Next step

The population definition is the step that often needs to be revisited later.

The audit management overview covers the engagement records, and the policy and compliance management guide for insurance covers the regulatory landscape for insurance policy management. Engagements that test controls across the whole risk framework connect to the governance, risk and compliance guide for insurance. For what the evidence trail should contain, the note on audit trail evidence is a practical companion, and for an outside review of the platform itself, see the ServiceNow health checks and audits service.