An internal auditor is assigned to perform an audit of the company's insurance program, including the appropriateness of the approach to minimizing risks to the company. The company self-insures against large casualty losses and health benefits provided for all its employees. The company is a large national firm with over 15,000 employees located in various parts of the country. It uses an outside claims processor to administer its health care program. The company's medical costs have been rising by approximately 8% per year for the past five years, and management is concerned with controlling these costs.