Internal Audit Requirements for Singapore Insurers: What MAS Expects

Internal Audit as a Regulatory Requirement

For Singapore-licensed insurers, an effective internal audit function is not optional. MAS's corporate governance guidelines and supervisory expectations make clear that the internal audit function is a required component of the governance framework for regulated financial institutions, including insurers.

The internal audit function sits as the third line of defence in the governance framework MAS endorses -- independent of the first line (business units) and second line (risk management and compliance) -- and provides the board and senior management with independent assurance that the control environment is working as intended.

This article explains what MAS expects of the internal audit function for licensed insurers and where common gaps arise.

The Regulatory Basis

MAS's expectations for internal audit in licensed financial institutions are primarily set out in:

MAS Guidelines on Corporate Governance (Insurers) (G-13) -- these establish the board's responsibility for ensuring that an adequate internal audit function exists and that it has the independence, resources and authority to do its job.

MAS's supervisory approach -- in inspections, MAS assesses the quality and effectiveness of internal audit as part of its broader governance review. An internal audit function that is underfunded, lacks independence, or produces reports that are not acted upon by management is a regulatory concern.

Board Audit Committee

For insurers above a certain size, MAS expects the board to establish an Audit Committee with responsibility for oversight of the internal audit function. The Audit Committee should:

• Approve the internal audit plan and ensure it covers key risk areas
• Review internal audit reports and track management actions on findings
• Assess the adequacy of internal audit resources
• Be the primary reporting line for the Head of Internal Audit, independent of management

For smaller insurers where a full Audit Committee may not be warranted, the full board or a board risk committee should assume these responsibilities. MAS does not prescribe a one-size-fits-all governance structure, but expects the oversight function to be genuinely independent of management.

The Head of Internal Audit (or equivalent) should have direct access to the board or Audit Committee and should not be required to route communications through management. This structural independence is foundational.

Scope of the Internal Audit Programme

The internal audit programme should cover all material risk areas and control functions across the insurer's operations. For a Singapore-licensed insurer, this typically includes:

Financial controls. Accuracy and integrity of financial records, month-end close processes, balance sheet reconciliations, and the controls supporting regulatory reporting.

Underwriting and claims. Controls over underwriting authority, pricing adherence, claims reserving, and fraud detection. These are core insurance operations and material areas of risk.

Compliance and regulatory. Adherence to MAS Notice requirements, market conduct obligations, AML/CFT controls, and data protection. Compliance audits should assess whether the compliance function itself is working effectively, not merely whether individual transactions are compliant.

IT and cybersecurity. Controls over technology systems, access management, change management, and incident response -- consistent with MAS's technology risk management expectations.

Outsourcing and third-party arrangements. Whether material outsourcing arrangements are being managed in accordance with MAS guidelines and internal policies.

Risk management function. Whether the risk management framework is operating as designed -- this is a second-line function audit.

The programme should be risk-based, with higher-frequency and deeper audits for areas of greater risk. A risk-based internal audit plan that does not align with the insurer's actual risk profile is itself an audit finding.

Audit Frequency and Coverage

MAS does not prescribe specific audit frequencies, but expects the internal audit plan to provide adequate coverage of all material risk areas within a reasonable cycle. For most insurers, this means:

• Core financial controls: annual
• High-risk areas (e.g. claims, underwriting, AML/CFT): annual or more frequent if warranted by risk indicators
• Lower-risk areas: every two to three years

The plan should be updated when the insurer's risk profile changes -- for example, when a new product line is launched, a significant outsourcing arrangement is entered into, or a new technology system is implemented.

Independence of Internal Audit

The independence of the internal audit function is critical to its value. MAS expects:

Organisational independence. The internal audit function should report to the board or Audit Committee, not to the Chief Executive or Chief Financial Officer. In practice, many internal audit functions have an administrative reporting line to the CEO but a functional reporting line to the Audit Committee -- the key is that the Audit Committee has control over the internal audit plan, resources and outcomes.

Freedom from management override. Management should not be able to direct internal audit to exclude areas from the audit scope or to water down findings. The Audit Committee should be informed of any attempts to limit the scope of internal audit work.

No operational responsibilities. Internal auditors should not take on operational or advisory responsibilities that would subsequently be within their audit scope. The two lines should be kept separate.

Insourcing vs Outsourcing Internal Audit

For smaller insurers, maintaining a dedicated internal audit function in-house may not be practical. MAS permits internal audit to be outsourced to an external provider, subject to appropriate oversight.

Where internal audit is outsourced, the board or Audit Committee must still exercise meaningful oversight -- the outsourcing does not outsource the governance responsibility. The Audit Committee should approve the audit plan, review reports, and assess whether the external provider is delivering adequate coverage.

Co-sourcing arrangements -- where an external provider supplements a small in-house team -- are also common for insurers that want in-house continuity but need specialist skills in areas such as IT audit or actuarial risk.

Common Findings in Internal Audit Reviews

In supervisory reviews and governance assessments, common internal audit weaknesses for Singapore insurers include:

Audit plans that are not genuinely risk-based. Plans that rotate evenly across all functions without weighting for risk expose the insurer to the possibility that high-risk areas are not reviewed frequently enough.

Management actions not tracked to completion. Internal audit findings that are acknowledged but not remediated, or where management actions are marked complete without verification, undermine the value of the function.

Under-resourcing. Internal audit teams that are too small to deliver meaningful coverage, or that lack the skills to audit specialist areas such as IT or actuarial risk, cannot provide the assurance the board needs.

Limited board engagement. Boards that receive internal audit reports but do not challenge management responses or track outstanding actions are not exercising effective oversight.

Audit scope limitations. Areas that are excluded from audit scope without documented rationale represent blind spots that regulators may identify.

Our enterprise risk management team assists Singapore-licensed insurers in reviewing their internal audit frameworks, preparing for MAS governance inspections, and strengthening the three-lines-of-defence structure. If you are assessing the adequacy of your internal audit function, our team is available to discuss your position.