Updated 01/09/26
The Agency Audit Section within the Department of Insurance and Financial Services (DIFS) Office of Insurance Licensing, Investigations, and Audits is responsible for proactively performing routine reviews of selected business entities to evaluate compliance with the Michigan Insurance Code (the Code) governing an insurance producer's fiduciary responsibilities, marketing and sales practices, licensing and appointment requirements, and other areas deemed necessary. MCL 500.249 gives DIFS the authority to examine the records of licensed insurance agencies and individuals to ascertain compliance with the applicable provisions in the Code. More information about the Code can be found on the Michigan Legislature website.
Below is a list of common questions regarding a routine review of an insurance agency:
All insurance agents and agencies licensed by the Michigan Department of Insurance and Financial Services (DIFS) are subject to routine compliance reviews. DIFS uses a random selection process to choose agencies for review, ensuring fairness and consistent oversight. The purpose of these reviews is to help licensed entities maintain sound business practices that prevent violations and to support the consistent application of Michigan’s insurance laws and regulations. Above all, the review process is designed to be both educational and regulatory, promoting compliance through guidance, collaboration, and transparency.
The review notification letter, also referred to as the call letter, is sent with a questionnaire and, in some cases, a data request letter. Please complete the questionnaire and data request by the due date(s) provided in the call letter. If you have any questions or concerns, please contact the Auditor-in-Charge at the phone number listed in the call letter. You may also call DIFS at 877-999-6442 to confirm the review and reach the Auditor-in-Charge.
The initial stage of the review involves the auditors gaining an understanding of the agency’s business operations through a questionnaire, data request, and entrance meeting. The entrance meeting allows for the opportunity to discuss the review process and to address any concerns the agency may have. It often includes an onsite visit to the insurance agency. The next stage is the examination of agency records and is intended to proactively evaluate compliance with pertinent Code provisions. After the review of the agency records, the audit team will compile the audit results and hold an exit meeting to discuss the results and recommendations, if any, with the insurance agency.
Often, the audit process involves remote examinations of agency records. However, the audit team may schedule onsite visits as needed throughout the review.
This will greatly depend upon the size and complexity of an insurance agency, whether the requested documents are provided in a complete and timely manner, and whether there are any issues noted for further discussion.
The initial contact is with the DRLP who is responsible for the business entity’s compliance with the state insurance laws, rules, and regulations. However, after the initial contact, the DRLP may designate an alternative person of contact to assist the audit team.
Legal representation is not required during the review. However, we do recommend having accounting personnel involved because many of the samples reviewed involve accounting transactions.
The audit process is designed to identify errors and/or weaknesses in the agency’s operations, which could lead to possible noncompliance with the Code.
The preferred method is to use the Egress secured folder that is created by the Auditor-in-Charge. This is a secure folder that requires an account name and login to access. It is a shared folder between members of the agency and DIFS’ audit team only. If you are unable to use Egress or if you have any questions or concerns, please contact the Auditor-in-Charge.
When providing documents to DIFS, please remove or redact any sensitive personally identifiable information such as date of birth, license numbers, social security numbers, etc., as such information is not necessary for the review. DIFS has procedures and processes in place to safeguard and protect the confidentiality of sensitive information received from agencies, whether electronic or physical. Pursuant to MCL 500.1246, information received from insurance producers is confidential by law, is privileged, and not subject to the Freedom of Information Act.
If certain requested documents are not available, please contact the Auditor-in-Charge immediately. The audit team can suggest alternative documents or contact third parties to obtain the necessary information.
The results may be communicated as “findings” or “observations.” Findings are substantive issues or instances when violations of the Code were found to have occurred. Observations are instances that do not reach the level of a ‘Finding’, but improvements of the entity’s practices are highly recommended.
To address the findings and observations, DIFS will provide recommendations, which are guidance in the correction of violations of the Code or to avoid possible gaps in insurance agency operation, which could cause harm to the agency and/or insureds.
The department's intention is to help bring the insurance agency into compliance. If violations are found, the department will ask that the insurance agency take corrective actions and implement/make updates to procedures and processes. Depending on the results, the department may have to refer the violations to the Office of General Counsel. In some cases, this may lead to administrative action including a fine.
After the sample review is complete, the Auditor-in-Charge will start the draft audit report and schedule an exit meeting. During the exit meeting, the audit team will review and discuss the audit results with the insurance agency. The draft report will go through an approval process, and once approved, the report will be issued to the agency. Typically, the audit report will be issued within 30 days of the exit meeting, and the agency will have 30 days to respond to the report. If the audit discovers Code violations, which do not appear to be isolated occurrences, you will receive a written document from DIFS regarding the next steps.
