Article
CPS 230 due diligence for an outsourced claims provider
Turn a private health claims outsourcing review into focused evidence requests, service-specific findings and a clear decision on unresolved risks.
Contrata editorial team ·
An outsourced claims provider may return a complete questionnaire while leaving the most important question unanswered: can it deliver the service your insurer is proposing to rely on?
The answer depends on the actual claims workflow, the provider's capability and the work your own team retains. Due diligence becomes more useful when each request is tied to a decision about that service, rather than a growing folder of policies.
This guide offers a practical evidence-request matrix for a fictional private health insurer. It is an original review method, not an APRA checklist or a complete assessment of outsourcing obligations.
Fix the scope before asking for evidence
CPS 230 requires appropriate due diligence before entering into or materially modifying a material arrangement, including ongoing capability and financial and non-financial risk assessment.
In this fictional example, Mariner Health is considering outsourcing part of its claims handling. The provider would receive selected claims, perform agreed checks and return outcomes. Mariner would retain defined decisions, oversight and certain exception handling. Neither organisation is a real customer example.
The review begins with a service description agreed by claims operations, procurement and risk. It identifies what is moving, what remains in-house, which systems exchange information and how the two teams handle exceptions.
This prevents an apparently strong response from answering the wrong question. Evidence about a provider's general contact-centre business may say little about the claims service, location or technology being proposed.
Build requests around decisions
The following matrix is a suggested starting point. Tailor it to the arrangement, your policy and the questions already answered by reliable evidence. Avoid sending every provider every possible request.
| Decision question | Evidence to request | Sufficiency check | If it remains unresolved |
|---|---|---|---|
| Can the provider handle the proposed work? | Service design, capacity assumptions, training and quality approach | Covers the proposed claim types and expected operating conditions | Ask for a scoped walkthrough or demonstration |
| Can the two teams handle exceptions? | Responsibility map, escalation procedure and example hand-offs | Names both parties' actions and decision points | Resolve ownership before relying on the process |
| Can the service recover? | Relevant recovery-test results and outstanding findings | Identifies systems, locations and dependencies included and excluded | Request service-specific explanation or further testing |
| Can records be reconciled? | Data-flow and reconciliation procedures | Explains incomplete, duplicate and uncertain transactions | Assign a joint operational design task |
| Is the delivery model understood? | Delivery locations, relevant subcontractor information and change process | Matches the proposed service rather than a generic corporate overview | Clarify the dependency and review its impact |
| Is ongoing delivery financially credible? | Appropriate financial information and relevant context | Period, entity and limitations are understood | Seek specialist assessment where needed |
| Can Mariner leave the arrangement? | Proposed transition support and sample data export | Usable by the insurer or a successor, with responsibilities clear | Test an export or refine the transition design |
The matrix is not a scoring formula. A convincing answer to six questions does not cancel a serious gap in the seventh.
Distinguish received evidence from sufficient evidence
For each item, record the service it covers, its date, its author or source and what conclusion it supports. Then record its limits.
A continuity document may describe an intended recovery process. A test report may show that part of the process worked under defined conditions. Neither should automatically be treated as proof that the whole claims service will remain available during every disruption.
Mariner receives a recovery-test summary for the provider's main platform. The summary excludes a document-intake component used by the proposed service. The reviewer records the test as useful evidence for the platform, with an open question about end-to-end recovery. It is neither rejected as worthless nor accepted as complete.
The follow-up request is specific: explain how document intake recovers, identify the dependencies and provide available evidence covering the connection to the claims workflow. The provider can now answer a bounded question rather than guess what “more BCP evidence” means.
Review the insurer's side of the arrangement
Outsourcing changes the work your team does; it does not make internal capability irrelevant. Mariner needs people who understand exceptions, can challenge performance information and can act when the provider escalates an issue.
Ask the internal service owner:
- Who can make decisions the provider is not authorised to make?
- Who checks that returned results match the work sent?
- What happens when the provider and insurer disagree about an outcome?
- Can staff access the information needed during a disruption?
- Which tasks become harder if the provider is unavailable for an extended period?
CPG 230 identifies retained in-house capability among considerations when assessing a prospective provider. Use that as a prompt to examine your own operating model, rather than treating due diligence as an assessment of the supplier alone.
Make unresolved questions decision-ready
A long issue list is difficult for an approver to use. Convert each material question into a short statement of consequence and a proposed response.
For example: “The available recovery evidence excludes document intake. We have not established whether claims received immediately before an outage can be recovered without manual reconstruction. The claims owner and provider will test the hand-off before the proposed start date.”
That statement explains the gap, why it matters and the next action. It avoids unsupported conclusions such as “provider recovery is inadequate” when the actual problem is missing evidence.
Give each issue an owner, target date and closure test. If the action is to obtain a document, specify what that document must establish. A file arriving should not close a question it does not answer.
Separate the decision from the administration
The due diligence pack should make it possible for the authorised decision-maker to see:
- What service is proposed and why.
- What alternatives were considered where relevant.
- Which conclusions the evidence supports.
- Which assumptions and risks remain.
- What must happen before commencement and what will be monitored afterwards.
- Who owns each condition and how completion will be checked.
Use your governance process to decide whether unresolved matters prevent progress, require a changed arrangement or can be addressed under documented conditions. Do not treat a completed questionnaire, a favourable average score or an approaching commercial deadline as the decision itself.
Where the proposal involves outsourcing a critical operation, ensure the required internal audit involvement is addressed through your governance process; the current standard's service-provider section is the controlling reference.
Carry findings into the live service
After a decision, transfer the relevant findings into the arrangement's monitoring and issue records. Otherwise, questions painstakingly resolved during procurement can disappear when the relationship moves to operations.
Mariner's first operational review should revisit the assumptions used in the assessment: actual workflow, delivery locations, exception volumes, reconciliation performance and the status of any recovery finding. The purpose is to check whether the service that started is the service that was assessed.
For difficult evidence requests, the assurance-report review helps distinguish scope from conclusions, while the targeted follow-up guide turns remaining gaps into specific questions.
For a general approach to organising review evidence, see the CPS 230 evidence checklist. For this claims arrangement, the immediate next step is narrower: choose the unresolved question most likely to change the decision, and ask for the evidence that would resolve it.