A lawyer found the error NSW's insurance regulator was meant to find

The error was found by someone doing long division

A lawyer looked at a client’s weekly payments, noticed they did not add up, and asked. That is the entire detection mechanism that worked here. Not the insurer’s controls. Not the regulator’s audit. One practitioner with a calculator.

NRMA Insurance, a trading name of Insurance Australia Limited, has repaid hundreds of people injured in motor vehicle accidents in New South Wales after failing to correctly calculate some compulsory third party benefits since 2019, according to the ABC. The insurer first estimated about 700 people were affected and later revised that down to 400, and has told the ABC it has identified a further cohort of people owed interest after receiving lump sums. The State Insurance Regulatory Authority, which had previously launched an audit of the company’s practices, did not pick the error up either.

An underpayment has no complainant

Compulsory third party cover is the insurance every driver in the state has to buy, and it funds payments to people hurt in crashes. The weekly benefit is set by a formula and is meant to be adjusted over time. The claimant receives a number in a letter. There is no invoice to check it against, no quote to compare, no second supplier offering a different figure.

That asymmetry is the whole story. If an insurer overpays, its own finance function eventually notices, because the money is leaving. If it underpays, the only party with both an incentive and a reason to care is a person recovering from a car accident who has never seen the indexation table. Errors in this direction are structurally silent. They do not generate complaints, because nobody knows there is something to complain about.

Which means a supervisory model built on complaints, self-reports and process audits is blind to exactly the failure mode the scheme is most likely to produce.

What an audit of practices does not do

Audits of practices examine documented procedures, file handling, decision quality, timeliness, training. All useful. None of it recalculates a payment.

And statutory benefits are the easiest thing in general insurance to check independently, because the regulator effectively owns both halves of the sum. SIRA sets the scheme rules. The inputs are a claimant’s earnings history, elapsed time and an indexation factor. Hand a supervisor a claim file and the published index and a spreadsheet settles it in under a minute. A regulator that never does this is choosing to be told rather than to check — and the limits of being told are set by what the firm is capable of finding in itself.

The revision from 700 to 400 is not the reassuring part

Populations move during remediation; that is normal as records are examined properly. But a 43 per cent revision, followed by the later discovery of a further group owed interest on lump sums, says something about how the affected set was assembled. A firm that could identify the cohort by query would not need to narrow it so sharply and then widen it again in a different direction. Scope that keeps moving is scope being discovered rather than measured — and it is a reason for the regulator to verify the final number rather than accept it.

The case for leaving it alone

The strongest version of the other side goes like this. Errors happen in every large payments operation. The money has been repaid. A regulator cannot recompute every payment in every scheme without becoming a second claims department at motorists’ expense. External scrutiny found the problem and remediation followed, which is roughly how the system is supposed to behave. Audits cannot be designed around every conceivable defect, and designing them around the last one is how supervisors end up fighting the previous war.

It is a serious argument, and it fails on one point. Nobody is asking for every payment to be checked. A few hundred randomly selected live claims per insurer per year, recomputed from source data against the published index, would have surfaced a 2019 error years before 2026. The cost of that is negligible against the premium pool. And the “external scrutiny worked” defence depends entirely on a lawyer being in the room. Not every injured claimant has one. A control that only fires when a represented claimant happens to check the arithmetic is not a control.

Automation is not the point

Greens MP Abigail Boyd said it blows her mind that a multi-billion-dollar company does not have an automated system for indexing payments correctly. The indignation is fair. The diagnosis is not quite right.

An automated calculation using the wrong factor is wrong four hundred times instead of once, silently and consistently, and it looks exactly as authoritative on the letter. Automation does not remove the need for verification; it concentrates it, because a single bad parameter now propagates across an entire book. The question worth asking of NRMA Insurance is not whether the calculation was automated but who checked its output against the scheme’s own numbers, how often, and with what independence. On the evidence so far, the answer appears to be a lawyer, once, in 2026.