Found by the Other Side's Lawyer: What the NRMA Underpayment Error Reveals About Your Detection Debt
When the first person to notice your control failure is someone who doesn't work for you, the failure is not the error. It's the detection.
The ABC reported this week that NRMA Insurance underpaid hundreds of injured NSW motorists — and that the error was spotted by a crash victim's lawyer, not the insurer and not the regulator. Every Board should treat that single sentence as a diagnostic. Your controls are not judged by what they prevent. They are judged by who finds what they missed.
There is a sentence in this week's reporting that should stop any Board chair mid-sip. The ABC reported on 12 October 2026 that NRMA Insurance underpaid hundreds of NSW accident victims in what was described as a 'mind blowing' error — and that the error was picked up by a lawyer acting for a crash victim who noticed his client's payment did not add up. Not by the insurer. Not by the NSW regulator.
We have only the headline and the excerpt, and we will not pretend otherwise. We do not know the quantum, the root cause, or the remediation. But we do not need any of that to extract the strategic lesson, because the lesson is contained entirely in who found it.
An external party, with no access to your systems, no visibility of your controls, and no financial incentive to audit you, arrived at the correct answer before you did. That is not a payments problem. That is a **detection problem** — and detection problems are governance problems wearing an operational disguise.