Audit - Total CSR Insurance Glossary

Written by Justin Goodman, CIC, CISC, CLCS, CEO and Co-Founder, Total CSR
Published: August 17, 2026 · Last reviewed: August 17, 2026

In plain language: An audit is the process where the insurance company checks the actual payroll, sales, or other numbers a business generated during the policy period, then adjusts the premium to match. Estimated premium at renewal is a guess. The audit corrects it.

Technical definition: Audit refers to a carrier's post-expiration or physical verification of exposure basis data, such as payroll, gross sales, or receipts, reported by the insured, used to calculate final earned premium under policies rated on variable exposures like workers' compensation and general liability, per ISO and NCCI rating rules. This process follows established audit standards and regulatory framework requirements to ensure transparency and accuracy in premium determination.

Audit at a Glance

Attribute	Detail
Also known as	Premium audit, payroll audit, final audit, annual audit
Category	Premium determination process
Lines of business	Workers' Compensation, General Liability, Commercial Auto
Industries most affected	Construction, staffing, manufacturing, retail, hospitality
Related forms or endorsements	WC 00 04 03 (Premium Audit and Audit Noncompliance Charge Endorsement, where used)
Who bears the risk	The insured, if actual exposure exceeds estimated exposure
Common solution	Interim audits, accurate class code assignment, clean payroll records
Also interacts with	Experience modification, deposit premium, minimum earned premium

Key Takeaways

Audit is the carrier's process of comparing actual exposure data, like final payroll or sales, against the estimate used to set the original premium, then billing or refunding the difference based on audit findings and audit verification procedures.
Audits matter in daily agency work because they generate additional premium bills that clients did not budget for, and unexplained audit bills are a leading source of client complaints and lost renewals.
The most common pitfall is treating estimated premium as final premium when quoting or binding, which sets client expectations that the audit will later contradict.
A quick win is scheduling a mid-term check-in with the audit client to compare actual year-to-date payroll or sales against the policy estimate, so the eventual audit result is never a surprise.

What Is Audit in Insurance?

Audit is the mechanism carriers use to charge premium that matches the risk a business actually presented during the policy period, rather than the risk estimated at the start. Workers' compensation and many general liability policies are rated on a variable exposure basis, most often payroll or gross sales, because that number moves with the size of the operation. Since no one knows exact year-end payroll on day one of the policy, the carrier estimates it, bills estimated premium, and then reconciles the estimate to reality through the audit. Unlike internal audit functions that organizations conduct themselves, compliance audit procedures performed by accounting firms, or specialized types of auditing such as energy audit, product audit, or sustainability audit assessments, insurance premium audits are typically external audit processes conducted by the carrier or a third-party audit firm specializing in insurance exposure verification.

The doctrine behind this is straightforward: premium should track exposure, not guesswork, ensuring transparency and government accountability in the rating system. A contractor who estimated $500,000 in payroll but actually paid $750,000 in payroll generated 50% more workers' compensation exposure than the carrier was originally paid to cover. The audit closes that gap through systematic audit verification and risk assessment. Without it, carriers would either overcharge low-growth businesses or systematically undercharge fast-growing ones, distorting the entire rating system and compromising audit quality across the industry. This approach differs from other types of auditing like single audit requirements for federal grant recipients or state auditor reviews of government entities, but shares the common goal of verification and accountability.

A concrete example: a landscaping company estimates $400,000 in annual payroll at policy inception and pays a deposit premium based on that figure. Business booms, and the company ends the year with $550,000 in actual payroll across its crews. The physical premium audit at expiration, conducted by a certified auditor following standards similar to ISO 19011 guidelines for auditing management systems, recalculates earned premium using the real $550,000 figure, and the carrier bills the difference as additional premium based on the final audit report.

How Does Audit Work?

The estimate and audit planning. The underwriter sets estimated premium at policy inception using projected payroll, sales, or another exposure basis provided by the applicant or agent. The audit program is established at this stage, defining audit scope and audit criteria for the eventual reconciliation. Many agencies now use an audit checklist to ensure all necessary documentation and planning steps are completed upfront.
The policy period. The insured operates under that estimate for the full term, with premium billed on an installment schedule tied to the estimated figure. During this audit cycle, the insured should maintain proper audit trail documentation including payroll records and financial statements, with appropriate safeguards to prevent data breach or unauthorized access to sensitive employee information.
The audit notification and preparation. Near or after expiration, the carrier initiates an audit, physical, phone, or self-reported, requesting actual payroll records, tax filings, or sales data for the period. This audit notification triggers the audit preparation phase where the audit client gathers necessary audit evidence and documentation, often with assistance from an audit liaison within the organization.
The entrance conference and field work. For physical audits, the audit team may conduct an entrance conference with the insured to explain the audit process, review audit criteria, and establish the audit scope. The auditor then performs field work, examining records and collecting audit evidence to verify exposure data and ensure internal controls were properly maintained.
The audit execution and reconciliation. The auditor applies the correct class codes to the actual exposure data, performs audit verification procedures, and recalculates earned premium for the full term. This audit execution phase may reveal audit findings that require clarification or corrective action from the insured.
The exit conference and draft audit report. Upon completing the audit, many auditors conduct an exit conference to discuss preliminary audit findings with the audit client. A draft audit report is often shared to allow the insured to review the calculations and provide any additional audit evidence before finalization.
The final audit report and bill or refund. After audit resolution of any disputed items, the carrier issues a final audit report documenting all audit findings and audit recommendations. The carrier then issues an additional premium invoice if actual exposure exceeded the estimate, or a return premium if it came in lower. Proper audit follow-up ensures any corrective action items are addressed for future audit cycles.

Real Claim Examples Involving Audit

General contractor payroll growth mid-recession recovery

A general contractor insured under a workers' compensation policy estimated $1.2 million in payroll at renewal based on the prior slow year. Construction demand rebounded and the contractor's actual payroll reached $1.9 million by year-end. The premium audit, conducted as part of the carrier's annual audit program, generated an additional premium bill exceeding $40,000, which the contractor disputed until the agency produced certified payroll records and audited financial statements supporting the original class code assignments. The audit findings stood after thorough audit verification, and the contractor implemented better audit preparation practices for subsequent years.

Staffing agency misclassified employee payroll

A staffing agency reported all employee payroll under a single clerical class code to save on estimated premium. The external audit reclassified a portion of the workforce to a higher-rated warehouse labor code based on actual job duties documented in time sheets, resulting in a substantial additional premium bill and a coverage dispute over whether the original classification was a misrepresentation. The audit report documented material misstatement in the exposure reporting, and the audit team recommended implementing stronger internal controls and preventive action measures to ensure accurate classification in future policy periods.

Retailer refund after seasonal sales decline

A retail client estimated gross sales of $2 million for a general liability policy rated on sales receipts. A slower-than-expected holiday season left actual sales at $1.6 million. The compliance audit produced a return premium, and the agency used the result to demonstrate the value of accurate exposure reporting when the client questioned next year's estimated premium increase. The audit findings provided transparency into the rating process and helped the client understand the relationship between exposure and premium.

Audit vs. Estimated Premium: What Is the Difference?

Audit and estimated premium are two stages of the same rating process rather than competing concepts. Estimated premium is the number billed at policy inception based on projected exposure, while audit is the later verification and correction process that produces final earned premium. Understanding these types of audits and their relationship to premium determination is essential for proper audit management and client communication.

Comparison area	Audit	Estimated Premium
Primary use case	Verifying actual exposure after the policy period through audit execution	Setting the initial premium at binding
Coverage / concept type	Process, not a coverage; similar to performance audit in other industries	Billing figure, not a coverage
Typical exclusions	Does not apply to fixed-premium policies	Not applicable, no exposure to estimate under fixed premium
Who is most affected by errors	Insured, through unexpected additional premium when being audited	Insured, through cash-flow mismatch at binding
Common mistakes	Treating audit bill as negotiable without proper audit evidence and documentation	Under-reporting exposure to lower initial premium

What Are the Most Common Mistakes With Audit?

Quoting estimated premium as if it were final, which sets a client expectation the audit later breaks, damaging trust in the agency even when the carrier's math is correct and the audit findings are properly documented.
Failing to track mid-term payroll or sales growth during the audit cycle, so a client is blindsided by a large additional premium bill instead of budgeting for it throughout the year with proper audit planning.
Ignoring audit noncompliance provisions in the audit notification, which can result in the carrier estimating exposure at an inflated figure and billing additional premium with no ability to dispute it after the fact, compromising audit resolution options.
Assuming general liability and workers' compensation use identical exposure bases, when GL is often rated on sales or payroll depending on classification, and applying the wrong basis skews the audit result and affects audit quality.
Not retaining copies of the original exposure estimate and supporting documentation to maintain a proper audit trail, leaving the agency unable to defend the client's position if the audit result is contested or audit findings are disputed.
Overlooking subcontractor certificates of insurance during the policy period, which causes uninsured subcontractor payroll to be swept into the insured's own payroll at audit time, similar to issues that might arise in a DOL audit or compliance audit of contractor relationships.
Poor audit preparation and lack of transparency with clients about the audit process, leading to surprise when the audit team requests documentation or when audit findings differ from expectations.
Failing to implement corrective action or preventive action measures after audit findings reveal classification errors or exposure reporting issues, resulting in repeated problems in subsequent audit cycles.

How to Explain Audit to a Client

Explaining Audit to a personal lines client

Audit typically does not apply to standard homeowners or personal auto policies, so this conversation rarely comes up for personal lines clients. If a personal umbrella or landlord policy involves rental income tracking, the CSR can simply note that any exposure-based premium may be adjusted later if actual rental income differs from the estimate, similar to how types of audits in commercial insurance verify actual exposure data.

Explaining Audit to a small business owner

Audit means the insurance company checked your actual payroll or sales after the policy year ended and compared it to the estimate we used to set your premium. If your business grew more than expected, you may owe additional premium based on the audit findings. If it grew less, you may get money back. The best way to avoid a surprise when being audited is to send us updated numbers partway through the year so we can flag any big swings early. Think of it like an annual audit that ensures you're paying the right amount for the coverage you actually used. The audit team will review your records, and you'll receive a final audit report showing how they calculated the adjustment. Good audit preparation, including keeping organized payroll records and financial statements, makes the process much smoother.

Explaining Audit to a CFO or risk manager

Audit is the reconciliation of estimated exposure basis, whether payroll, sales, or receipts, against actual reported figures for the policy term, producing final earned premium through a systematic audit verification process. Given your organization's growth trajectory, I'd recommend a mid-term interim audit or at minimum a payroll reforecast at the six-month mark as part of your audit planning, so the year-end true-up doesn't create a cash-flow surprise for budgeting. We should also confirm your subcontractor certificate tracking is current, since uninsured subs can be swept into your own payroll during the audit. The audit scope will cover all exposure bases, and the audit team will examine your audit trail including payroll records, tax filings, and potentially audited financial statements. Maintaining strong internal controls and transparency throughout the audit cycle helps ensure audit quality and minimizes disputes. The audit process follows established audit standards and regulatory framework requirements, similar to external audit procedures you may be familiar with from your financial audits conducted by accounting firms or oversight reviews like PCAOB inspection reports for public company auditors. Organizations with quality management system certifications such as ISO 9001 or environmental management system standards like ISO 14001 will find the documentation requirements familiar, as insurance audits follow comparable verification principles outlined in ISO 19011. After the entrance conference and field work, you'll receive a draft audit report for review before the final audit report is issued, allowing for audit resolution of any questions. Implementing any audit recommendations and corrective action from previous audits demonstrates good audit management and can streamline future audit execution.

Frequently Asked Questions About Audit

What happens if I don't respond to an audit request?

Carriers can apply an audit noncompliance charge and estimate your exposure at a higher figure than actual, often resulting in a larger bill than a completed audit would have produced. Responding promptly to the audit notification with actual payroll or sales records and proper audit preparation is almost always cheaper than ignoring the request. The audit team needs your cooperation to produce accurate audit findings, and failure to provide audit evidence can compromise the entire audit verification process and limit your audit resolution options.

Can an audit result in a refund instead of a bill?

Yes, if actual exposure came in lower than the estimate used to set premium, the audit produces return premium. This is common when a business experiences a slower year than projected at renewal. The final audit report will document the calculation, and the refund demonstrates the transparency and fairness of the audit process.

How long after my policy expires does the audit happen?

Timing varies by carrier and policy type, but audits typically occur within 90 days of policy expiration as part of the standard audit cycle, sometimes sooner for larger accounts subject to physical audit. Self-reported audits for smaller accounts may be requested by mail or online portal shortly after expiration. The audit notification will specify deadlines for audit preparation and submission of required documentation.

Does every policy get audited?

No, only policies rated on a variable exposure basis, such as payroll for workers' compensation or sales for many general liability classifications, are subject to audit. Fixed-premium policies, like most personal auto and homeowners policies, are not audited. The types of audits conducted vary by policy type and carrier audit program, but all follow similar audit standards for verification and documentation.

Can I dispute an audit result?

Yes, insureds can request a review or reaudit if they believe class codes were misapplied or exposure figures are incorrect in the audit findings. Supporting audit evidence, such as certified payroll records, tax filings, or audited financial statements, strengthens a dispute significantly. The audit resolution process allows you to work with the audit team to address any material misstatement or errors in the draft audit report before the final audit report is issued. Proper documentation and a clear audit trail are essential for successful disputes.

Why did my audit bill come in so much higher than expected?

Large audit bills usually trace back to underestimated exposure at binding, payroll growth during the term, or subcontractors without their own coverage being swept into the insured's payroll. Reviewing the auditor's worksheet and final audit report against original class codes usually identifies the specific driver. Poor audit planning and lack of mid-term monitoring during the audit cycle often contribute to surprise bills. The audit findings should provide transparency into how the additional premium was calculated, and the audit team can explain the audit criteria and audit verification procedures used.

What is the difference between a first-party audit, second-party audit, and third-party audit in insurance?

In insurance premium audits, a first-party audit would be an internal review by the insured's own staff, though this is rare in premium determination. A second-party audit is conducted by the insurance carrier's own audit team. A third-party audit is performed by an independent audit firm contracted by the carrier to conduct the audit execution and produce the audit report. Most insurance premium audits are either second-party or third-party audits, following established audit standards and regulatory framework requirements regardless of who performs them.

How can I improve my audit preparation?

Effective audit preparation includes maintaining organized records throughout the policy period, establishing a clear audit trail for all payroll and exposure data, implementing strong internal controls for classification and reporting, and designating an audit liaison within your organization to coordinate with the audit team. Regular review of your exposure data against estimates, proper documentation of subcontractor certificates, and prompt response to audit notification all contribute to smoother audit execution. Consider conducting periodic internal audit reviews of your exposure reporting to identify issues before the external audit occurs. Following audit recommendations and implementing corrective action from previous audits also demonstrates good audit management and can improve audit quality in future cycles. Many organizations now use digital platforms like AuditBoard to streamline audit preparation, document management, and communication with auditors, making the process more efficient and reducing the risk of data breach during information exchange.

What audit checklist items should I prepare before an insurance audit?

A comprehensive audit checklist should include: complete payroll records by employee and classification code, quarterly tax filings (941s), certificates of insurance for all subcontractors, general ledger entries for the policy period, sales records or receipts if applicable, and documentation of any mid-term changes in operations. Having this audit checklist prepared in advance streamlines the audit process and reduces the likelihood of delays or estimated charges.

Related Insurance Terms

Estimated premium: the initial premium charged at policy inception based on projected exposure, later corrected through the audit process and documented in the final audit report.
Exposure basis: the measurable unit, such as payroll, sales, or square footage, used to rate a policy and later verified during audit through systematic audit verification and audit evidence collection.
Experience modification: a factor applied to workers' compensation premium based on historical loss experience, calculated separately from but alongside audited payroll figures, often requiring audited financial statements and performance audit data.
Audit noncompliance charge: a penalty premium applied when an insured fails to cooperate with an audit request or audit notification, often based on estimated rather than actual exposure, compromising audit quality and audit resolution options.
Deposit premium: the upfront premium payment based on estimated exposure, which the audit later reconciles to actual earned premium through the audit cycle and audit execution process.
Minimum earned premium: a contractual floor on premium that a carrier will retain regardless of audit results showing lower exposure, documented in the audit criteria and final audit report.
Compliance audit: in insurance contexts, may refer to audits verifying adherence to policy terms, classification rules, or regulatory requirements, distinct from but related to premium audits.
Information technology audit (IT audit): increasingly relevant in insurance as carriers adopt digital audit management systems and online portals for audit preparation, audit notification, and submission of audit evidence.
Risk assessment: the underwriting process that establishes initial exposure estimates and audit criteria, which the audit later verifies through examination of actual operations and audit findings.
ISO 9001: an international standard for quality management system requirements that shares documentation and verification principles with insurance audit processes, particularly regarding record-keeping and process control.
ISO 14001: an environmental management system standard that, like ISO 9001, establishes frameworks for systematic documentation and verification that parallel insurance audit requirements.
ISO 19011: the international standard providing guidelines for auditing management systems, offering principles and practices applicable to insurance premium audit execution and audit quality control.
PCAOB (Public Company Accounting Oversight Board): the regulatory body overseeing auditors of public companies, whose PCAOB inspection reports and audit standards provide a framework for audit quality and independence that influences best practices across audit disciplines including insurance.
Quality management system: an organizational framework for consistent processes and documentation that supports accurate exposure reporting and smoother insurance audits.
Environmental management system: a structured approach to managing environmental impacts that, when properly documented, can facilitate insurance audits for environmental liability policies.
Triple bottom line: a sustainability framework measuring social, environmental, and financial performance that increasingly influences risk assessment and audit scope for insureds with sustainability commitments.
Sustainability audit: an assessment of environmental, social, and governance practices that may intersect with insurance audits when carriers evaluate risk profiles for organizations with sustainability programs.
Product audit: a quality control process examining manufactured goods that may affect product liability insurance audits and exposure verification for manufacturers.
Energy audit: an assessment of energy consumption and efficiency that can impact property insurance audits and risk evaluation for energy-intensive operations.

Sources and References

National Council on Compensation Insurance (NCCI). Premium Audit.

About the Author

Justin Goodman, CIC, CCIP, CISC, CLCS, CRIS, PCIA, QCLS, MFHR
CEO and Co-Founder, Total CSR, Inc.

Justin Goodman is a third-generation insurance broker with over two decades in agency operations. He has trained more than 50,000 CSRs, account managers, and producers in commercial and personal lines coverage, from workers' compensation to construction risk. He was named 2024 Insurance Journal Agent of the Year and one of the nation's top five construction insurance experts by Risk & Insurance. He is the author of Retain, which applies cognitive science research on memory and knowledge transfer to insurance training, and speaks nationally on how agencies build durable technical expertise in their teams.

Connect with Justin on LinkedIn