Introduction
The General Insurance Code of Practice is the Insurance Council of Australia’s code for general insurers. Adopting it is voluntary, but once an insurer adopts it the Code becomes a contract with the ICA, and the Code Governance Committee can impose sanctions for breaches.¹ The current version commenced on 5 October 2021 and was last updated in October 2023.²
Most people who work with the Code know it for its rules on selling, cancellation, vulnerable customers and complaints. Less well known outside claims operations is that the Code sets specific standards for how a claim may be investigated. For a fraud team those standards decide the timeframes, the interview conduct, what external investigators must record, and when surveillance is allowed. This article sets them out with the paragraph numbers, so they can be checked.
What the Code covers, and what it does not
The Code applies to general insurance products, with exceptions that matter here. It does not cover workers compensation, marine, medical indemnity, motor vehicle injury insurance or domestic builders insurance.³ Motor vehicle injury insurance means compulsory third party (CTP) cover, so CTP claims are governed by the scheme regulators rather than the Code.
The claims and vulnerability parts apply to retail insurance only.³
Where the Code and the law conflict, the law prevails.⁴ The Code adds obligations on top of the law; it does not replace them.
The timeframes that apply to every investigated claim
Part 8 of the Code, on making a claim, sets the clock.
- Within 5 business days of appointing an investigator or an employee to investigate, the insurer must tell the customer, and the investigation must follow the claims investigation standards in Part 15.⁵
- Once all information is in and enquiries are complete, the decision must be communicated within 10 business days.⁶
- The decision must be made within 4 months of receiving the claim, unless one of the paragraph 78 exceptions applies.⁷
- Where the claim is fraudulent or the insurer reasonably suspects it is, the outer limit becomes 12 months, and the customer must be told the decision in writing within that time. Suspected fraud is one of five listed exceptions, alongside catastrophe, a customer not responding, communication difficulties and a customer-requested delay.⁷
Fraud suspicion buys time, but not unlimited time, and it does not switch off the other standards.
Part 15: the claims investigation standards
Part 15 is the section a fraud team should know by heart. Its general obligations come first.
Investigators may look only at the matters they need to, and must do so in an appropriate and respectful manner.⁸ The insurer must run a quality assurance programme over its investigations, which may include reviewing interview recordings, investigators’ records and complaints, including disputes that go to the Australian Financial Complaints Authority (AFCA).⁹
One paragraph deserves attention from anyone who runs detection rules. Under paragraph 195 the quality assurance programme must include reviews of the insurer’s non-genuine claims indicators, at least once a year, to make sure they remain relevant, appropriate and do not discriminate.¹⁰ The indicators that generate referrals are, in the Code’s eyes, part of the investigation and subject to the same scrutiny.
If an investigation has gone on for 4 months, the claim must be independently reviewed by an employee with appropriate authority, knowledge or experience, the customer must be told, and the review may take no more than 30 calendar days. The reviewer decides whether there is sufficient cause to continue; if not, the claim goes for a decision.¹¹ After the review the insurer must tell the customer in writing why it has not been able to decide and what information is still missing.¹²
Requests for information must be reasonable, relevant, made in one request where possible, and explained. Instructions to investigators must limit the purpose to the claim in question and define the scope and the period of information sought.¹³ Before an investigation starts the insurer must explain why, and tell the customer verbally and in writing about the process, the primary contact, the investigator’s role, when to expect contact, the 10 business day decision commitment, their rights and responsibilities, and the complaints process.¹⁴ Progress updates are due at least every 20 business days.¹⁵
Interviews
The interview rules are the most detailed part of the standards.
Before a formal interview the customer must be told in writing the purpose, their rights and responsibilities, their right to a free interpreter, who will conduct it, that an external investigator acts on the insurer’s behalf, the expected length, the insurer’s contact details, their right to a legal representative or support person, and how it will be recorded.¹⁶ Interviews with anyone under 18 need a necessity assessment by trained professionals, written approval of the scope, and a parent, guardian or responsible adult present.¹⁷
During the interview: a single sitting may last no more than 90 minutes; a further sitting needs at least a 24 hour break unless otherwise agreed; more than 4 hours in total needs the insurer’s written consent with reasons; a 5 minute break must be offered every 30 minutes, and breaks do not count towards the 90 minutes.¹⁸ Investigators must record every offer of a break and the response.¹⁹
Afterwards the customer is entitled to a free transcript or recording, and to a copy of the previous record before any second interview.²⁰
External investigators
Where an external investigator is used, the insurer must give written instructions for each investigation, confirm any changes, and require consent before instructions are exceeded.²¹ Investigators working with people who may be vulnerable must have been trained for it.²² The insurer must keep an up to date register of investigators’ licences and expiry dates.²³
Investigators must keep contemporaneous written records of all activity, including conversations, unanswered calls, written communications, travel, interviews and any electronic checks such as land titles or social media, and those records must be kept for at least 7 years.²⁴ They may collect information only where they reasonably believe it is relevant, may not use illegal means, may not induce anyone to do something they would not otherwise have done, may not make threats, promises or inducements, and must obtain the insurer’s authority before alleging fraud.²⁵
Surveillance
Surveillance may be authorised only after alternative methods have been considered, only where the insurer reasonably believes the claim appears inconsistent with the information available and has recorded its reasons, and only with approval from a suitably experienced employee.²⁶ It may not take place in a court, a medical facility, a bathroom or change room, inside the customer’s home, or at business premises not open to the public.²⁷ It must stop if the insurer becomes aware of a pre-existing mental health condition, and investigators may not reveal it to neighbours or colleagues.²⁸
What this means for a fraud operation
Read together, the standards describe a system rather than a set of good intentions. Dates have to be tracked from the day an investigator is appointed. Every instruction, change of instruction and authority to allege fraud has to be recorded. Investigator licences have to be registered and checked. Interview offers and breaks have to be logged. Referral indicators have to be reviewed for discrimination at least once a year. And a claim approaching 4 months has to be surfaced for review before the deadline, not after it.
That is the list kbs built its Code of Practice Compliance features against: due dates per claim, contact dates, an investigator portal with licensing and training records, alerts against the Code’s timeframes, a review queue for claims nearing four months, and appointment and decline letters from templates.²⁹
What is changing
The ICA commissioned an independent review of the Code, which reported in December 2024, and a redrafted Code went to public consultation between 24 June and 21 July 2026. No commencement date for the new Code had been announced when this was written.² The paragraph numbers above refer to the October 2023 update and will need checking when the new Code is published.
Related Topics
Special Investigations Unit (SIU)
Human-in-the-loop decision making
Workflow management in fraud and compliance
Sources & further reading
¹ General Insurance Code of Practice, October 2023 update, paragraphs 14 to 16
² Insurance Council of Australia, Code of Practice page (read 22 September 2026)
³ Code, paragraphs 10 to 12
⁴ Code, paragraphs 18 to 20
⁵ Code, paragraph 73
⁶ Code, paragraph 76
⁷ Code, paragraphs 77 and 78
⁸ Code, paragraph 193
⁹ Code, paragraph 194
¹⁰ Code, paragraph 195
¹¹ Code, paragraphs 196 to 198
¹² Code, paragraph 199
¹³ Code, paragraph 200
¹⁴ Code, paragraphs 201 and 202
¹⁵ Code, paragraph 204
¹⁶ Code, paragraph 205
¹⁷ Code, paragraph 211
¹⁸ Code, paragraphs 214 to 216 and 219
¹⁹ Code, paragraph 221
²⁰ Code, paragraphs 222 and 223
²¹ Code, paragraph 225
²² Code, paragraph 227
²³ Code, paragraph 228
²⁴ Code, paragraphs 229 and 230
²⁵ Code, paragraph 231
²⁶ Code, paragraph 232
²⁷ Code, paragraph 233
²⁸ Code, paragraphs 234 and 235
²⁹ kbs Intelligence, Code of Practice Compliance, kbsintelligence.io/compliance/code-of-practice-compliance/
