Skip to content
GL20 compliance has become an essential benchmark for insurers aiming to demonstrate sound governance, risk management, and operational resilience. Unlike traditional compliance frameworks that primarily focus on policy documentation, GL20 places emphasis on active, embedded, and auditable control systems that directly impact enterprise value. It calls for insurers to adopt a more integrated and measurable approach to compliance, embedding it within their business strategy, customer outcomes, and day-to-day operations.
Unfortunately, many insurers still rely on outdated or superficial compliance practices. To genuinely meet the spirit and letter of GL20, here are the top 10 practical and strategic controls every insurer must prioritize—especially the ones most insurers continue to overlook.
1. Centralised Control Repository with Real-Time Control Testing
Spreadsheets and disconnected systems are no longer adequate. A centralised control repository allows for:
- Unified visibility into all risk, compliance, and operational controls.
- Role-based access for control owners, testers, and auditors.
- Integration with internal systems to automate control testing and trigger alerts when failures occur.
This control ensures insurers can maintain an audit-ready posture and proactively manage emerging risks without relying on manual reviews.
Example: Automate the testing of financial reconciliation controls by integrating with your ERP and flagging any breaks that exceed materiality thresholds.
2. Claims Leakage Detection Controls Using Pattern Recognition
GL20 goes beyond just process compliance—it expects insurers to demonstrate how controls mitigate financial risk in real-time. Claims leakage, often underestimated, can drain millions without triggering any red flags.
Set up controls that:
- Detect unusual claims frequency from certain intermediaries.
- Compare average claim sizes across geographies and product types.
- Flag early-inception claims on high-value policies for manual review.
Implementation Tip: Use AI-based anomaly detection systems to constantly review historical claims data and create baseline patterns.
3. Underwriting Governance Controls for Product Suitability
Product design and distribution must be backed by defensible governance processes. GL20 requires that insurers demonstrate alignment between product characteristics and target market needs.
Robust controls should include:
- Board-level product approval workflows.
- Documented Target Market Determinations (TMDs).
- Pre-launch actuarial validation and stress testing of underwriting assumptions.
Key Risk: Misalignment between underwriting risk appetite and customer needs, leading to increased churn or disputes.
4. Independent Model Validation and Documentation
Financial models—used for pricing, reserving, capital planning—carry systemic risk. Yet many insurers lack proper documentation and governance over model updates.
GL20-compliant controls require:
- Regular independent review of critical models.
- Documented assumptions, data sources, limitations, and override protocols.
- Traceable approval workflow for changes to models.
Audit Tip: Maintain a model inventory with risk ratings, last validation date, and owner accountability.
5. Customer Duty Controls with End-to-End Visibility
As customer outcome regulations like the Financial Accountability Regime (FAR) and Design and Distribution Obligations (DDO) gain traction, GL20 expects insurers to prove they’re measuring and governing customer-centric outcomes.
Controls should measure:
- First-call resolution and complaint resolution timelines.
- Policy lapse rates segmented by age, channel, or demographic.
- Correlation between complaint trends and claims denial rates.
Best Practice: Link these metrics to executive performance indicators and present them in quarterly risk reports.
6. Third-Party Algorithm Risk Controls
Insurers increasingly rely on TPAs, InsurTech vendors, and BPOs. However, GL20 stipulates that you’re still responsible for ensuring these partners uphold your control standards.
Create controls that:
- Vet algorithm logic and bias in AI-driven underwriting or claims systems.
- Mandate data lineage and auditability.
- Require annual compliance attestations and control self-assessments from vendors.
Advanced Practice: Require all vendors to share their latest SOC 2 Type II or ISO 27001 reports.
7. Board-Level Risk Appetite Monitoring Controls
While most insurers publish a risk appetite statement, very few tie it back to active decision-making and breach reporting.
GL20 requires:
- Real-time dashboards showing where actual exposure exceeds stated appetite.
- A breach escalation log that reaches the Board Risk Committee.
- Risk-adjusted performance indicators (RAPIs) to support strategic decisions.
Common Miss: Not updating risk appetite metrics to reflect new product launches or market expansions.
8. Financial Crime Controls with Cross-Product Surveillance
Financial crime risks—fraud, AML, insider trading—are often addressed in product-specific silos. GL20 requires a horizontal approach.
Effective controls include:
- Velocity checks across life and general insurance portfolios.
- Pattern recognition for unusual refund or cancellation activity.
- Integration with national and international watchlists for onboarding screening.
9. Regulatory Intelligence Monitoring Controls
GL20 mandates that insurers not only comply with current rules but actively track and respond to evolving regulation.
Set up controls to:
- Subscribe to APRA, ASIC, AUSTRAC, and international regulatory updates.
- Assign regulatory changes to specific business owners with deadlines.
- Maintain an audit log of how each regulatory change was assessed, actioned, or ruled irrelevant.
Avoid This Trap: Updating internal policies but not re-training staff or updating workflows—this creates a false sense of compliance.
10. Control Effectiveness Scoring and Audit-Ready Dashboards
GL20 audits focus not only on the presence of controls but their demonstrated effectiveness.
Mature insurers:
- Score each control quarterly based on test results, incidents, and age.
- Present board-level dashboards with RAG (red-amber-green) status.
- Track remediation status of weak controls in real-time.
Bonus: Use control scoring to allocate budget—stronger business cases for areas with historically weak control environments.
Turning Compliance Into Competitive Advantage
GL20 compliance is an opportunity, not just an obligation. Insurers who treat it as a strategic enabler will:
- Improve trust with customers, investors, and regulators.
- Minimize losses from operational failures or financial crime.
- Reduce audit burden with streamlined, tech-enabled controls.
The controls outlined above are not just theoretical—forward-thinking insurers are already using them to reduce costs, accelerate decision-making, and boost boardroom confidence.
If your current GL20 program isn’t measuring up to these standards, now is the time to pivot.
Reach out to us at ComplyNexus for a tailored GL20 control checklist, internal presentation templates, or a peer benchmark scorecard—let’s get your compliance strategy audit-ready and future-proof.
