Last year I wrote about why quality assurance (QA) matters in pensions administration: it protects members, strengthens trust and supports good governance.
Since then, the context has changed. The Pensions Regulator’s General Code is now in force. Enhanced online member self-service is expanding, dashboards are moving closer to reality, and schemes are accelerating automation to manage demand and cost pressures. QA needs to evolve too.
Assurance should not sit at the end of the process; it must be embedded in governance, operations, technology and member communications.
What's changed, and why QA needs to evolve
The Pensions Regulator’s General Code places greater emphasis on effective systems of governance, internal controls and the ability to evidence how those controls work. QA can form an important part of a scheme’s wider assurance framework and provide valuable evidence to support its Own Risk Assessment.
At the same time, factor updates, rectification projects and changing tax and legislative requirements create more opportunities for error. Digital journeys and straight-through processing can allow a small mistake to affect many members quickly. As dashboards and self-service develop, data quality will become increasingly visible to members.
Automation and AI can improve efficiency, but they introduce new risks. Their outputs, data inputs and underlying controls must be tested and monitored as carefully as traditional calculations.
Four practical approaches
- Use risk-based assurance
Not every case requires the same level of checking. Apply a simple risk score based on factors such as benefit type, value, member vulnerability, manual intervention and recent rule changes.
High-risk or manual cases may require detailed checking, while lower-risk cases may be subject to proportionate sample checking and periodic reviews. Review outputs regularly, particularly errors found after issue, and adjust the sampling approach where necessary.
- Build QA into design and change
QA should begin before a process reaches live operation. Build controls into calculation engines and workflows, including effective-date checks, data validation, version-controlled factors and calculation tools and reasonableness checks.
Have clear segregation between the person completing a calculation and the person checking it. Maintain appropriate test packs and rerun them whenever systems, factors or rules change. Controls should also cover operational resilience, including testing whether backup, recovery and incident-response arrangements work in practice.
- Treat data quailty as part of QA
Define data-quality rules for mandatory fields, valid ranges and permissible combinations, with clear ownership for maintaining them. Monitor data quality regularly and identify whether problems originate in employer uploads, manual input, legacy migrations or system interfaces.
Data incidents should be managed like other operational incidents: assess member impact, identify the root cause and record preventive action. This is important as dashboards and digital services increase reliance on accurate, timely and well-matched data.
- Assure communications, automation and AI
QA should focus on member outcomes, not only calculations. Maintain a controlled library of templates with agreed terminology, version histories and review dates. Check high-volume communications for accuracy, readability and accessibility, including alternative formats and plain-language explanations where appropriate.
Automation and spreadsheets should have named owners, documented purposes, defined inputs and outputs, and evidence of testing. Where AI or large language models are used, outputs should be reviewed, inputs restricted to approved data and usage limited to clearly defined tasks. Piloting in low-risk areas is sensible, but it does not replace effective governance.
Controls that prevent errors and improve service
Practical controls can stop issues reaching members and reduce rework. Examples include:
- validating retirement dates, factors and benefit amounts
- comparing first pension payments and lump sums with quotation values and agreed tolerances
- using outlier detection to identify unusual accrual, negative service or duplicate records
- verifying bank details and member identity
- requiring dual approval for large or first payments
The right controls will depend on the scheme’s risks but should be proportionate, documented and reviewed when processes or systems change.
Measure whether QA is working
Metrics are useful only when linked to risk and materiality. Schemes should consider monitoring:
- right-first-time performance
- errors identified after issue, by severity and root cause
- rework and complaints
- QA coverage by risk band
- processing times and backlog ageing
Materiality thresholds should reflect the potential impact on members, for example, the value of an incorrect payment or the consequences of missing a payment date. Reporting should highlight trends and significant risks.
Learn from errors
When errors occur, the priority is to identify affected members, put benefits right promptly and prevent recurrence. A shared classification of root causes ,such as data, rules, system logic, manual error, communication or automation failure, can make reviews more consistent.
A short, fact-based review should record what happened, the member impact, corrective actions, owners and deadlines. If the same cause recurs, the response should move beyond retraining to changes in process, system design or supplier management.
Final thought
QA cannot be a tick box exercise. Done well, it helps schemes deliver one of the most fundamental outcomes of good pensions administration: paying the right benefits to the right people at the right time, first time.
By making QA risk-based, technology-aware, member-focused and properly evidenced, schemes can reduce errors, complaints and rework while strengthening governance and meeting regulatory expectations.
Effective QA does more than catch mistakes: it helps prevent them, freeing administrators to spend more time improving services and supporting members.
Disclaimer
The views expressed are the author’s own and the opinions in this blog post are not intended to provide specific advice. For our full disclaimer, please see the About this blog page.
Recent Comments