Independent insurance agencies and MGAs: what an audit looks like

State department of insurance (California is the worked example)

California's market conduct exams cover licensed insurers under Insurance Code 730, which ties scheduling and scope to the NAIC Examiner's Handbook criteria. Separately, the Commissioner may inspect any agent's or broker's records at any time and demand the information they contain (Insurance Code 1727).

How often. Insurers at least once every five years. The statute sets no cycle for agent and broker records, which are open to inspection at any time.

Source ↗

Insurance carriers (contract audits of agencies and MGAs)

NAIC exam standards test whether an insurer monitors entities acting on its behalf, keeps producer licensing and appointment records that match the department's, and checks that producer account balances follow the producer's contract. One program administrator agreement filed with the SEC keeps the administrator's records open to the carrier at all times and requires premiums in a separate fiduciary bank account with statements sent to the carrier.

How often. Set by each contract; carriers do not publish audit cycles. The filed agreement requires records kept at least seven years from termination of each policy.

Source ↗

New York DFS under 23 NYCRR Part 500 (agencies licensed in New York)

Agencies and brokers licensed under the Insurance Law are covered entities. In October 2025 DFS fined Hagerty Insurance Agency, LLC $1.85 million over an exposed consumer quoting tool and ineffective access controls, including for its broker portal.

How often. Annual notice of compliance or acknowledgment of noncompliance by April 15, with supporting records kept five years. A limited exemption applies if any one test is met: fewer than 20 employees and contractors, under $7.5 million revenue in each of three years, or under $15 million in assets.

Source ↗

Producer account balances and the carrier contract

NAIC Producer Licensing Standard 6 tests that producer account balances are in accordance with the producer's contract with the insurer. The standards give no retention period of their own; Operations/Management Standard 7 requires records to be adequate, accessible, consistent and orderly and to comply with state record retention requirements.

NAIC Market Regulation Handbook Examination Standards Summary 2025, ch. 20, Producer Licensing Standard 6 and Operations/Management Standard 7Source ↗

Producer licensing and appointment records

Records of licensed and appointed producers that agree with the department's records, continuing education where required, and termination records that document the reasons.

NAIC Market Regulation Handbook, ch. 20, Producer Licensing Standards 1 to 5Source ↗

Written information security program

A comprehensive written information security program, controls that protect computer information, an antifraud program and a valid disaster recovery plan.

NAIC Market Regulation Handbook, ch. 20, Operations/Management Standards 2, 3, 4 and 17Source ↗

Complaint register, sales materials and privacy notices

Complaints recorded on the register with handling procedures and response times, advertising and sales materials, and the privacy notices given to customers.

NAIC Market Regulation Handbook, ch. 20, Complaint Handling Standards 1 to 4, Marketing and Sales Standard 1, Operations/Management Standards 12 and 13Source ↗

Policy files and transactions

State examiners following the NAIC standards test that the rates charged match filed rates or the rating plan, that mandated disclosures are documented, and that policies are issued or renewed accurately, timely and completely.

Complaint files

The NAIC complaint handling standards test that each complaint is recorded on the register in the required format, finalized and disposed of under the applicable rules, and answered within the required time frame.

Producer licenses

NAIC exams test that producers were licensed, appointed and current on required continuing education in the jurisdiction where the application was taken, and that the entity's producer records agree with the insurance department's records.

Carrier-requested premium reporting

A filed carrier agreement requires a monthly accounting of net and collected premiums by the 15th of the following month, plus all bank statements for the fiduciary premium account.

Quoting tools and agent portals that exposed consumer data

Eight settlements totaling more than $19 million, including $1.85 million for Hagerty Insurance Agency, LLC 2025

DFS found web applications and agent portals that exposed driver's license numbers and policies that were not implemented as written. State Auto was also cited for not requiring independent agents to use multi-factor authentication.

Source ↗

Annual approval of the cybersecurity policy

In New York the policy must be approved at least annually by a senior officer or the senior governing body. The annual notice is signed by the highest-ranking executive and the CISO.

Policies implemented as written

Hagerty had written policies on application development and customer data privacy. DFS found the quoting tool's design reflected a failure to implement them, and that the development procedures did not cover externally facing applications.

Training evidence

Part 500 requires cybersecurity awareness training at least annually for all personnel, including social engineering. DFS also penalized renewal applications that reported continuing education the producer had not taken, and NAIC standards test whether producer training materials meet statutes and rules.

Oversight of MGAs, vendors and delegated work

NAIC standards test contracts with MGAs, general agents and TPAs and whether the entity monitors those acting on its behalf. Part 500 requires written third-party service provider policies with due diligence and periodic assessment.