Buy Template
New
100%
of controls with evidence before audit fieldwork
3 weeks
less audit preparation each year
0
repeat findings in the 2026 audit
At a glance
Company
Fernway Insurance
Size
1,200 employees · home and auto insurance in six states
Agents
Vera
Systems connected
Policy administration, payments, identity provider, data warehouse
Live in
26 days
The challenge
Fernway tests 140 controls every year for its regulators and auditors: who approved a refund, whether a payment matched a policy, whether a leaver’s access was removed. The evidence lived in five systems. Each spring, a compliance team of six spent about six weeks pulling screenshots and exports, and gaps surfaced too late to fix. The 2025 audit found two repeat issues, both about evidence that existed but couldn’t be found in time.
What they put in place
Vera collects evidence for each control as the activity happens: approvals from the payments system, access changes from the identity provider, policy checks on premium refunds. It files each piece in the Run Log against its control, and checks refunds and premium adjustments against Fernway’s written policy as they’re made.
Vera never clears an exception on its own. A possible policy breach goes to Andre Castillo’s team with the transaction and the policy clause attached, and any control still missing evidence 14 days before fieldwork is flagged by name.
Rollout
Day 1: Kickoff. Target: evidence for every control before fieldwork.
Days 2–8: Read-only access to five systems; the 140 controls mapped to their sources.
Days 9–16: Policy checks written as guardrails and replayed against a quarter of refunds.
Days 17–25: Shadow mode; the compliance team reviewed each evidence item.
Day 26: Live, with a weekly gap report.
Results
Every control had its evidence before the 2026 fieldwork began, and the audit closed with no repeat findings. Preparation took three weeks less than the year before.
Policy checks on refunds flagged 37 exceptions in the first half of the year, each reviewed by a person within a day. Auditors now receive a Run Log export instead of a folder of screenshots.
The evidence used to be somewhere in five systems. Now it’s filed as it happens, and Vera tells us what’s missing while there’s still time to fix it.
Andre Castillo
Head of Compliance
Wardlow
Agents that do the work. People stay in charge.
Floor 4, 612 Bryant Street, San Francisco, CA 94107
SOC 2 Type II · ISO 27001 · GDPR · HIPAA
© 2026 Wardlow, Inc.
Crafted
by Jeeth