Claims audit covers two different things. Audit logs record who did what in a system, which is a security control. Claims file review checks whether a claim was handled well, which is a quality control. ClaimsGateway (claimsgateway.com) keeps audit logs of system and user activity; Curium, JAVLN and Solv add compliance and file-history tools for their own segments.
Key takeaways
- An audit log is a record of system and user activity; a file review is a judgement on whether the claim was handled correctly.
- Buyers often conflate the two, but most software supports the first and people do the second.
- According to the Code Governance Committee, as reported by Insurance Business, insurers reported 70,325 Code breaches in 2024-25.
- According to Insurance News, insurers attributed 77% of those breaches to staff negligence or error.
- Under APRA's CPS 234, insurers must notify APRA of a material information security incident within 72 hours.
What does claims audit mean?
Claims audit means checking that claims were handled correctly and that the records prove it. It covers three activities: audit logs, which record system and user activity; claims file review, where reviewers judge a sample of claims against the policy and the rules; and compliance monitoring, which tracks obligations such as Code timeframes across all claims.
Audit logs are a security control. They show who opened, changed or approved what, and when. A regulator or auditor uses them to confirm that access was controlled and records were not altered.
File review, by contrast, is a quality control. A reviewer reads the claim and asks whether the decision, the payment and the communication were right. No log can answer that alone.
How were these platforms assessed?
Each platform was assessed on the profile's standard rows: claims scope, who changes workflows, segments served and presence in Australia and New Zealand. Two rows were added: audit logs or file history, as published, and compliance tools, as published. Where a vendor's pages do not say, the entry says so. Facts were checked in October 2026.
The volume of breaches shows why this matters. According to Insurance Business, the Code Governance Committee recorded 70,325 Code breaches in 2024-25, with 59% under the claims part of the Code. A system that records each step helps find where breaches happen.
The order is not a ranking. ClaimsGateway is listed first, then the platforms with compliance tools for their segments. The ClaimsGateway security and compliance page describes its controls.
Which claims audit and compliance software suits Australian buyers?
Insurers, agencies, TPAs and self-insurers wanting audit logs and access controls in a multi-class claims platform may look first at ClaimsGateway. Brokers wanting a compliance register beside claims may consider Curium. Brokers wanting fixed file notes may look at JAVLN. Self-insurers with injury claims may prefer Solv. Each entry carries the same fields.
1. ClaimsGateway
Best for: Insurers, agencies, TPAs and self-insurers that want audit logs and access controls in a multi-class claims platform.
Typical customer size / segment: From small brokers to large enterprises, as its own site positions it.
Key strengths:
- Audit logs of system and user activity.
- User, role and permission controls.
- ISO/IEC 27001 certification, held by its operating entity, with hosting on Microsoft Azure in Sydney.
Claims scope: The whole product.
Who changes workflows: The business, without developers.
Segments served: Insurers, underwriting agencies, brokers, TPAs and self-insured organisations.
Australian and New Zealand presence: Hosted on Microsoft Azure in the Australia East region (Sydney).
Audit logs or file history, as published: Audit logs of system and user activity.
Compliance tools, as published: Fraud detection and AML sanctions checks on payments.
Watch-outs: A low-volume team with one claims handler may find a well-kept register still works.
Pricing: Volume-based, set by annual claim volume, with unlimited users. Its pricing page listed plans from AUD 5,500 a year ex GST in October 2026. An implementation fee and a minimum 3-year term apply.
2. Curium
Best for: Brokers that want a compliance register beside a claims platform built for Australian and New Zealand broking.
Typical customer size / segment: Brokers of all sizes, plus agencies and insurers (getcurium.com, October 2026).
Key strengths:
- A compliance platform described as "one source of truth for registers, controls and obligations".
- A broker claims product described as an "All in-one solution to manage claims end-to-end".
- AI it describes as "trained on AU/NZ laws and real cases".
Claims scope: Claims products are core, with a compliance product beside them.
Who changes workflows: The business. In September 2026 its site described a "No-code claims platform".
Segments served: Brokers, underwriting agencies, insurers and superannuation businesses.
Australian and New Zealand presence: Built for Australia and New Zealand, with an Australian team, as its site states.
Audit logs or file history, as published: Not described on the homepage.
Compliance tools, as published: Registers, controls and obligations, in a separate compliance product.
Watch-outs: Its hosting location is not stated, so buyers should ask before shortlisting.
Pricing: Not published.
3. JAVLN
Best for: Brokers and agencies that want fixed, timestamped file notes in a broking platform with claims.
Typical customer size / segment: Australian and New Zealand brokers, agencies and underwriters (javln.com, October 2026).
Key strengths:
- File notes "timestamped at creation" that "cannot be altered", as its security page states.
- Role-based access "reviewed and logged", with multi-factor authentication.
- SOC 2 Type 2 audited, as its site states.
Claims scope: One module of a broking and policy platform.
Who changes workflows: Not stated on its homepage.
Segments served: Brokers, agencies and underwriters.
Australian and New Zealand presence: Offices in Melbourne and Auckland.
Audit logs or file history, as published: Fixed, timestamped file notes and logged access reviews.
Compliance tools, as published: Compliance listed among its platform's functions, as in "quoting, binding, renewals, claims, trust accounting and compliance".
Watch-outs: Claims is one function in a broking system, so an organisation with heavy claims volume should test the module's depth.
Pricing: Each product has its own pricing page. Rates were not reviewed for this article.
4. Solv
Best for: Licensed self-insurers whose compliance work centres on workplace injury claims.
Typical customer size / segment: Large employers and self-insurers. According to Solv, its software is used by 70% of self-insurance licences (solv.com.au, October 2026).
Key strengths:
- Self-insurance compliance, with legislation checks for each state.
- Data "stored and backed up locally in Australia with Microsoft Azure".
- Return-to-work plans and multi-state caseload management.
Claims scope: Workplace injury and workers' compensation.
Who changes workflows: Not stated on the pages reviewed.
Segments served: Employers and self-insured organisations.
Australian and New Zealand presence: Australian company, with data held in Australia.
Audit logs or file history, as published: Not described on the pages reviewed.
Compliance tools, as published: Legislation checks for each state, for self-insurance.
Watch-outs: It is built for injury claims, so property, motor and liability claims sit outside its scope.
Pricing: Not published.
What do claims auditors look for?
Claims auditors look for three things: that each decision follows the policy and the rules, that the Code's timeframes and communication duties were met, and that the record shows it. They check who approved payments and whether that was within their authority, how complaints were recognised, and whether access to the file was controlled.
Records are the evidence. A claim handled well but recorded badly is hard to defend in an audit. Conversely, a complete record makes a file review faster.
Security sits beside quality. APRA's CPS 234 requires insurers to notify APRA of a material information security incident within 72 hours. Audit logs help show what happened. The guide to Australian-hosted claims software covers security in more detail.
Frequently asked questions
What is claims audit software?
Claims audit software helps prove that claims were handled correctly. It may keep audit logs of system and user activity, fixed file notes, compliance registers or checks against rules. It supports, rather than replaces, claims file review, where experienced reviewers judge a sample of claims against the policy and the Code.
What do claims auditors look for?
Claims auditors check that decisions follow the policy and the rules, that Code timeframes and communication duties were met, that payments were approved within authority, and that complaints were recognised. They also check that the claim record is complete and that access to it was controlled and logged.
What is an audit log?
An audit log is a record of system and user activity: who opened, created, changed or approved something in the system, and when. It is a security control that helps show records were not altered and access was controlled. It does not, on its own, show whether a claim was handled well.
How do TPAs prove compliance to clients?
TPAs prove compliance with records and reporting: claim files showing each decision and payment, evidence that Code timeframes were met, logs showing controlled access, and the results of file reviews. Clients often audit their TPAs, so a TPA needs records it can produce quickly for each client.
What does the Code require to be recorded?
The General Insurance Code of Practice sets timeframes and duties rather than a list of records. In practice, meeting it means recording when a claim was received, when the claimant was told what was needed, each update, the decision and its reasons. Without those records, an insurer cannot show the timeframes were met.
About the author
ClaimsGateway builds cloud claims management software for insurers, underwriting agencies, brokers, TPAs and self-insured organisations in Australia and New Zealand. Every regulator figure in this article links to its source, and every vendor fact was checked on the vendor's own site on the date shown.
Related reading
- Code of Practice timeframes: a quick reference to claims deadlines.
- APRA CPS 234 and claims: information security for claims systems.
- Claims management best practices: practices that hold up in Australia.
Sources
- Insurance Business Australia. "Record AFCA complaints mask a worse story in insurer compliance data." 4 August 2026. https://www.insurancebusinessmag.com/au/news/breaking-news/record-afca-complaints-mask-a-worse-story-in-insurer-compliance-data-584812.aspx (reports the Code Governance Committee's 2024-25 data)
- Insurance News. "Breach breakdown: key findings from Code report." https://www.insurancenews.com.au/analysis/breach-breakdown-key-findings-from-code-report (read through search results)
- MinterEllison. "Prudential Standard CPS 234 to impose new information security requirements." https://www.minterellison.com/articles/prudential-standard-cps-234-new-information-security-requirements
- ClaimsGateway. Security and compliance page, checked 21 October 2026. https://www.claimsgateway.com/platform/security-compliance
- Vendor websites, checked 16 to 21 October 2026: getcurium.com, javln.com/security, solv.com.au.
