Corporate Investigation: Insurance Company

A State Regulator was in the middle of an extensive examination of an insurance company that fell under its jurisdiction. The insurance company was suspected of engaging in certain activities that may have been in violation of certain state and federal regulatory guidelines. The insurance regulators had been working on the examination for a number of months until the examination finally reached a phase where the analysis of particular computer systems was necessary to find out more information. The insurance company, not wanting to lose its ability to do business or jeopardize its license, had up till then cooperated with the state regulators, albeit indirectly. The state regulators had conducted a few onsite interviews, had reviewed documents supplied to them by the insurance company and had begun to build a file with respect to particular activities at the insurance company. However, the regulators had difficulty obtaining and interpreting all of the information, procedures and practices of the insurance company due to the company’s intense use of computerized systems in every aspect of its business. The insurance company also was doing business in other states, and regulators from those states were in similar predicaments. The computer systems used by the insurance company were state-of-the-art and the functionality and use of those systems were way beyond the expertise of the regulators. The regulators knew that in order to ferret out the truth regarding what the insurance company was doing behind the scenes, those systems must be reviewed and analyzed.

Global Digital Forensics, Inc. (“GDF”) was contacted by the state regulators to assist their examination team. GDF staged its investigation into two parts. First, GDF analysts used general and hard-to-find public information to build a digital dossier on the insurance company and its many affiliates and associated individuals. These results were gathered and presented to the state regulators before proceeding to the second phase of the investigation, the onsite examination of the insurance company’s digital assets, including extensive interviews with the insurance company’s technology staff, operations personnel, as well as an intense review of the computer systems being used at the insurance company.

GDF first reviewed public and digital resources associated with the insurance company and its affiliates. Onsite work included interviews with IT and operations staff and examination of available computer systems, documents and industry materials. Inconsistencies between sources led the regulators to ask further questions and expand their review.

The findings were shared with the relevant regulatory parties, and the account describes a subsequent multi-state review. The confidential record is not reproduced here. The examination helped the regulators connect business practices to system records; the regulatory decisions remained theirs.

This was an insurance-company business-systems examination. It does not demonstrate testing of industrial controls, SCADA or other operational technology.